CVE-2022-23506

Spinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer builds

Description

Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds. This can lead to exposure of sensitive AWS credentials in packer log files. Versions 1.29.2, 1.28.4, and 1.27.3 of Rosco contain fixes for this issue. A workaround is available. It's recommended to use short lived credentials via role assumption and IAM profiles. Additionally, credentials can be set in `/home/spinnaker/.aws/credentials` and `/home/spinnaker/.aws/config` as a volume mount for Rosco pods vs. setting credentials in roscos bake config properties. Last even with those it's recommend to use IAM Roles vs. long lived credentials. This drastically mitigates the risk of credentials exposure. If users have used static credentials, it's recommended to purge any bake logs for AWS, evaluate whether AWS_ACCESS_KEY, SECRET_KEY and/or other sensitive data has been introduced in log files and bake job logs. Then, rotate these credentials and evaluate potential improper use of those credentials.

Category

4.3
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.09%
Third-Party Advisory github.com Third-Party Advisory github.com
Affected: spinnaker spinnaker
Published at:
Updated at:

References

Link Tags
https://github.com/spinnaker/spinnaker/security/advisories/GHSA-2233-cqj8-j2q5 third party advisory mitigation
https://github.com/spinnaker/rosco/commit/e80cfaa1abfb3a0e9026d45d6027291bfb815daf third party advisory patch

Frequently Asked Questions

What is the severity of CVE-2022-23506?
CVE-2022-23506 has been scored as a medium severity vulnerability.
How to fix CVE-2022-23506?
To fix CVE-2022-23506, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-23506 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2022-23506 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-23506?
CVE-2022-23506 affects spinnaker spinnaker.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.