id: GO-2023-1533
modules:
    - module: github.com/anchore/syft
      versions:
        - introduced: 0.69.0
        - fixed: 0.70.0
      vulnerable_at: 0.69.1
summary: Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in github.com/anchore/syft
cves:
    - CVE-2023-24827
ghsas:
    - GHSA-jp7v-3587-2956
references:
    - advisory: https://github.com/anchore/syft/security/advisories/GHSA-jp7v-3587-2956
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-24827
    - fix: https://github.com/anchore/syft/commit/9995950c70e849f9921919faffbfcf46401f71f3
source:
    id: GHSA-jp7v-3587-2956
    created: 2024-08-20T11:30:48.175309-04:00
review_status: UNREVIEWED
unexcluded: EFFECTIVELY_PRIVATE