GHSA-ghfh-fmx4-26h8
OpenBao leaks HTTPRawBody in Audit Logs
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/openbao/openbao | >= 0.0.0-20241114205727-b1235e585db7, < 0.0.0-20251022165510-cc2c476bac66 | 0.0.0-20251022165510-cc2c476bac66 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacted the following subsystems:
- When using the ACME functionality of PKI, this would result in short-lived ACME verification challenge codes being leaked in the audit logs.
- When using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs.
Third-party plugins may be affected.
### Patches
OpenBao v2.4.2 will patch this issue.
### Workarounds
If users do not use the above functionality, they are not impacted. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use.
References
External links from the advisory. They lead to third-party sites.