id: GO-2022-1178
modules:
    - module: github.com/bradleyfalzon/ghinstallation
      versions:
        - fixed: 1.1.2-0.20210308182858-d24f14f8be70
      vulnerable_at: 1.1.1
      packages:
        - package: github.com/bradleyfalzon/ghinstallation
          symbols:
            - Transport.refreshToken
            - Transport.Token
          derived_symbols:
            - Transport.RoundTrip
summary: JWT leak in github.com/bradleyfalzon/ghinstallation
description: |-
    Errors returned by ghinstallation.Transport can include the JWT used for the
    failed operation. If the error is exposed to an untrusted party, this JWT could
    be extracted and used to authenticate further requests.
cves:
    - CVE-2022-39304
ghsas:
    - GHSA-h4q8-96p6-jcgr
credits:
    - '@Miskerest'
references:
    - advisory: https://github.com/bradleyfalzon/ghinstallation/security/advisories/GHSA-h4q8-96p6-jcgr
    - fix: https://github.com/bradleyfalzon/ghinstallation/commit/d24f14f8be70d94129d76026e8b0f4f9170c8c3e
    - web: https://docs.github.com/en/developers/apps/building-github-apps/authenticating-with-github-apps#authenticating-as-an-installation