id: PYSEC-2020-41
details: In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT)
  used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`,
  etc.) is shown in plain text in EasyBuild debug log files. This issue is fixed in
  EasyBuild v4.1.2, and in the `master`+ `develop` branches of the `easybuild-framework`
  repository.
affected:
- package:
    name: easybuild-framework
    ecosystem: PyPI
    purl: pkg:pypi/easybuild-framework
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 4.1.2
  versions:
  - "1.0"
  - 1.0.1
  - 1.0.2
  - 1.1.0
  - 1.2.0rc1
  - 1.2.0
  - 1.3.0
  - 1.4.0
  - 1.5.0
  - 1.6.0
  - 1.7.0
  - 1.8.0
  - 1.8.1
  - 1.8.2
  - 1.9.0
  - 1.10.0
  - 1.11.0
  - 1.11.1
  - 1.12.0
  - 1.12.1
  - 1.13.0
  - 1.14.0
  - 1.15.0
  - 1.15.1
  - 1.15.2
  - 1.16.0
  - 1.16.1
  - 1.16.2
  - 2.0.0
  - 2.1.0
  - 2.1.1
  - 2.2.0
  - 2.3.0
  - 2.4.0
  - 2.5.0
  - 2.6.0
  - 2.7.0
  - 2.8.0
  - 2.8.1
  - 2.8.2
  - 2.9.0
  - 3.0.0
  - 3.0.1
  - 3.0.2
  - 3.1.0
  - 3.1.1
  - 3.1.2
  - 3.2.0
  - 3.2.1
  - 3.3.0
  - 3.3.1
  - 3.4.0
  - 3.4.1
  - 3.5.0
  - 3.5.1
  - 3.5.2
  - 3.5.3
  - 3.6.0
  - 3.6.1
  - 3.6.2
  - 3.7.0
  - 3.7.1
  - 3.8.0
  - 3.8.1
  - 3.9.0
  - 3.9.1
  - 3.9.2
  - 3.9.3
  - 3.9.4
  - 4.0.0
  - 4.0.1
  - 4.1.0
  - 4.1.1
references:
- type: WEB
  url: https://github.com/easybuilders/easybuild-framework/pull/3248
- type: WEB
  url: https://github.com/easybuilders/easybuild-framework/pull/3249
- type: ADVISORY
  url: https://github.com/easybuilders/easybuild-framework/security/advisories/GHSA-2wx6-wc87-rmjm
aliases:
- CVE-2020-5262
- GHSA-2wx6-wc87-rmjm
modified: "2020-03-23T18:15:00Z"
published: "2020-03-19T17:15:00Z"