id: GO-2022-0706
modules:
    - module: go.elastic.co/apm
      versions:
        - fixed: 1.11.0
      vulnerable_at: 1.10.0
      packages:
        - package: go.elastic.co/apm
          symbols:
            - modelWriter.buildModelTransaction
          derived_symbols:
            - NewTracer
            - NewTracerOptions
summary: Information disclosure in go.elastic.co/apm
description: |-
    Sensitive HTTP headers may not be properly sanitized before being sent to the
    APM server if the program panics.
published: 2021-05-18T18:34:18Z
cves:
    - CVE-2021-22133
ghsas:
    - GHSA-qqc5-rgcc-cjqh
references:
    - fix: https://github.com/elastic/apm-agent-go/pull/888
    - fix: https://github.com/elastic/apm-agent-go/commit/dd3e8c593580e7b80a98b57e1cc6e017e56747b4