CVE catalog

CVE-2024-6104

golang-github-hashicorp-go-retryablehttp: CVE-2024-6104

[CVE catalog]

Severity
Medium · CVSS 6CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.36% · Oct 25, 2026

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-hashicorp-go-retryablehttpsid0.7.1-1vulnerable
Debiangolang-github-hashicorp-go-retryablehttpforky0.7.1-1vulnerable
Debiangolang-github-hashicorp-go-retryablehttptrixie0.7.1-1vulnerable
Debiangolang-github-hashicorp-go-retryablehttpbookworm0.7.1-1vulnerable
Susepodmanlinux micro 6.04.9.5-12.1fixed
Opensusegrafanatumbleweed11.5.4-1.1fixed
Susepodmanlinux micro 6.04.9.5-4.1fixed
Susepodmanlinux micro 6.04.9.5-8.1fixed
Susepodmanlinux micro 6.04.9.5-2.1fixed
Susepodmanlinux enterprise micro 5.54.9.5-150500.3.15.1fixed
Susepodmanlinux enterprise module for containers 15 sp54.9.5-150500.3.15.1fixed
Susepodmanlinux enterprise module for containers 15 sp64.9.5-150500.3.15.1fixed
Opensusepodmanleap 15.54.9.5-150500.3.15.1fixed
Opensusepodmanleap 15.64.9.5-150500.3.15.1fixed
Susepodmanlinux enterprise micro 5.34.9.5-150400.4.47.2fixed
Susepodmanlinux enterprise micro 5.44.9.5-150400.4.47.2fixed
Susepodmanlinux enterprise high performance computing 15 sp4-espos4.9.5-150400.4.47.2fixed
Susepodmanlinux enterprise high performance computing 15 sp4-ltss4.9.5-150400.4.47.2fixed
Susepodmanlinux enterprise server 15 sp4-ltss4.9.5-150400.4.47.2fixed
Susepodmanlinux enterprise server for sap applications 15 sp44.9.5-150400.4.47.2fixed
Susepodmanlinux enterprise micro 5.34.9.5-150400.4.44.1fixed
Susepodmanlinux enterprise micro 5.44.9.5-150400.4.44.1fixed
Susepodmanlinux enterprise high performance computing 15 sp4-espos4.9.5-150400.4.44.1fixed
Susepodmanlinux enterprise high performance computing 15 sp4-ltss4.9.5-150400.4.44.1fixed
Susepodmanlinux enterprise server 15 sp4-ltss4.9.5-150400.4.44.1fixed
Susepodmanlinux enterprise server for sap applications 15 sp44.9.5-150400.4.44.1fixed
Opensusegolang-github-prometheus-prometheustumbleweed2.53.0-2.1fixed
Susepodmanlinux enterprise high performance computing 15 sp3-ltss4.9.5-150300.9.49.2fixed
Susepodmanlinux enterprise server 15 sp3-ltss4.9.5-150300.9.49.2fixed
Susepodmanlinux enterprise server for sap applications 15 sp34.9.5-150300.9.49.2fixed
Susepodmanlinux enterprise micro 5.14.9.5-150300.9.49.2fixed
Susepodmanlinux enterprise micro 5.24.9.5-150300.9.49.2fixed
Susepodmanenterprise storage 7.14.9.5-150300.9.49.2fixed
Opensuseteleporttumbleweed15.4.7-1.1fixed
Susepodmanlinux enterprise micro 5.54.9.5-150500.3.18.1fixed
Susepodmanlinux enterprise module for containers 15 sp54.9.5-150500.3.18.1fixed
Susepodmanlinux enterprise module for containers 15 sp64.9.5-150500.3.18.1fixed
Opensusepodmanleap micro 5.54.9.5-150500.3.18.1fixed
Opensusepodmanleap 15.54.9.5-150500.3.18.1fixed
Opensusepodmanleap 15.64.9.5-150500.3.18.1fixed
Suseghpackage hub 15 sp52.53.0-bp155.2.12.1fixed
Opensuseghleap 15.52.53.0-bp155.2.12.1fixed
Opensusepodmantumbleweed5.1.1-2.1fixed
Susepodmanlinux enterprise micro 5.34.9.5-150400.4.30.1fixed
Susepodmanlinux enterprise micro 5.44.9.5-150400.4.30.1fixed
Susepodmanlinux enterprise high performance computing 15 sp3-ltss4.9.5-150300.9.46.1fixed
Susepodmanlinux enterprise server 15 sp3-ltss4.9.5-150300.9.46.1fixed
Susepodmanlinux enterprise server for sap applications 15 sp34.9.5-150300.9.46.1fixed
Susepodmanlinux enterprise micro 5.14.9.5-150300.9.46.1fixed
Susepodmanlinux enterprise micro 5.24.9.5-150300.9.46.1fixed
Susepodmanenterprise storage 7.14.9.5-150300.9.46.1fixed
Susepodmanlinux enterprise micro 5.54.9.5-150500.3.43.2fixed
Susepodmanlinux enterprise module for containers 15 sp64.9.5-150500.3.43.2fixed
Susepodmanlinux enterprise module for containers 15 sp74.9.5-150500.3.43.2fixed
Susepodmanlinux enterprise high performance computing 15 sp5-espos4.9.5-150500.3.43.2fixed
Susepodmanlinux enterprise high performance computing 15 sp5-ltss4.9.5-150500.3.43.2fixed
Susepodmanlinux enterprise server 15 sp5-ltss4.9.5-150500.3.43.2fixed
Susepodmanlinux enterprise server for sap applications 15 sp54.9.5-150500.3.43.2fixed
Opensusepodmanleap 15.64.9.5-150500.3.43.2fixed
Suseghpackage hub 15 sp62.53.0-bp156.2.6.1fixed
Opensuseghleap 15.62.53.0-bp156.2.6.1fixed
Susepodmanlinux enterprise micro 5.54.9.5-150500.3.40.1fixed
Susepodmanlinux enterprise module for containers 15 sp64.9.5-150500.3.40.1fixed
Susepodmanlinux enterprise high performance computing 15 sp5-espos4.9.5-150500.3.40.1fixed
Susepodmanlinux enterprise high performance computing 15 sp5-ltss4.9.5-150500.3.40.1fixed
Susepodmanlinux enterprise server 15 sp5-ltss4.9.5-150500.3.40.1fixed
Susepodmanlinux enterprise server for sap applications 15 sp54.9.5-150500.3.40.1fixed
Opensusepodmanleap 15.64.9.5-150500.3.40.1fixed
Opensuseghtumbleweed2.53.0-1.1fixed
Susepodmanlinux enterprise micro 5.14.9.5-150300.9.34.1fixed
Susepodmanlinux enterprise micro 5.24.9.5-150300.9.34.1fixed
Susepodmanenterprise storage 7.14.9.5-150300.9.34.1fixed
Susepodmanlinux enterprise micro 5.34.9.5-150400.4.30.1fixed
Susepodmanlinux enterprise micro 5.44.9.5-150400.4.30.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-hashicorp-go-retryablehttpsourcesid(unfixed)not yet assignedNot reported[1076773]
Debiangolang-github-hashicorp-go-retryablehttpsourceforky(unfixed)not yet assignedNot reported[1076773]
Debiangolang-github-hashicorp-go-retryablehttpsourcetrixie(unfixed)not yet assignedNot reported[1076773]
Debiangolang-github-hashicorp-go-retryablehttpsourcebookworm(unfixed)not yet assignedNot reported[1076773]
Susepodmanrpmlinux micro 6.04.9.5-12.1Not reportedSUSE-SU-2026:22516-1Not reported
Opensusegrafanarpmtumbleweed11.5.4-1.1Not reportedOPENSUSE-SU-2025:15052-1Not reported
Susepodmanrpmlinux micro 6.04.9.5-4.1Not reportedSUSE-SU-2025:20198-1Not reported
Susepodmanrpmlinux micro 6.04.9.5-8.1Not reportedSUSE-SU-2025:20869-1Not reported
Susepodmanrpmlinux micro 6.04.9.5-2.1Not reportedSUSE-SU-2025:20080-1Not reported
Susepodmanrpmlinux enterprise micro 5.54.9.5-150500.3.15.1Not reportedSUSE-SU-2024:2286-1Not reported
Susepodmanrpmlinux enterprise module for containers 15 sp54.9.5-150500.3.15.1Not reportedSUSE-SU-2024:2286-1Not reported
Susepodmanrpmlinux enterprise module for containers 15 sp64.9.5-150500.3.15.1Not reportedSUSE-SU-2024:2286-1Not reported
Opensusepodmanrpmleap 15.54.9.5-150500.3.15.1Not reportedSUSE-SU-2024:2286-1Not reported
Opensusepodmanrpmleap 15.64.9.5-150500.3.15.1Not reportedSUSE-SU-2024:2286-1Not reported
Susepodmanrpmlinux enterprise micro 5.34.9.5-150400.4.47.2Not reportedSUSE-RU-2025:02091-1Not reported
Susepodmanrpmlinux enterprise micro 5.44.9.5-150400.4.47.2Not reportedSUSE-RU-2025:02091-1Not reported
Susepodmanrpmlinux enterprise high performance computing 15 sp4-espos4.9.5-150400.4.47.2Not reportedSUSE-RU-2025:02091-1Not reported
Susepodmanrpmlinux enterprise high performance computing 15 sp4-ltss4.9.5-150400.4.47.2Not reportedSUSE-RU-2025:02091-1Not reported
Susepodmanrpmlinux enterprise server 15 sp4-ltss4.9.5-150400.4.47.2Not reportedSUSE-RU-2025:02091-1Not reported
Susepodmanrpmlinux enterprise server for sap applications 15 sp44.9.5-150400.4.47.2Not reportedSUSE-RU-2025:02091-1Not reported
Susepodmanrpmlinux enterprise micro 5.34.9.5-150400.4.44.1Not reportedSUSE-SU-2025:1037-1Not reported
Susepodmanrpmlinux enterprise micro 5.44.9.5-150400.4.44.1Not reportedSUSE-SU-2025:1037-1Not reported
Susepodmanrpmlinux enterprise high performance computing 15 sp4-espos4.9.5-150400.4.44.1Not reportedSUSE-SU-2025:1037-1Not reported
Susepodmanrpmlinux enterprise high performance computing 15 sp4-ltss4.9.5-150400.4.44.1Not reportedSUSE-SU-2025:1037-1Not reported
Susepodmanrpmlinux enterprise server 15 sp4-ltss4.9.5-150400.4.44.1Not reportedSUSE-SU-2025:1037-1Not reported
Susepodmanrpmlinux enterprise server for sap applications 15 sp44.9.5-150400.4.44.1Not reportedSUSE-SU-2025:1037-1Not reported
Opensusegolang-github-prometheus-prometheusrpmtumbleweed2.53.0-2.1Not reportedOPENSUSE-SU-2024:14092-1Not reported
Susepodmanrpmlinux enterprise high performance computing 15 sp3-ltss4.9.5-150300.9.49.2Not reportedSUSE-RU-2025:02092-1Not reported
Susepodmanrpmlinux enterprise server 15 sp3-ltss4.9.5-150300.9.49.2Not reportedSUSE-RU-2025:02092-1Not reported
Susepodmanrpmlinux enterprise server for sap applications 15 sp34.9.5-150300.9.49.2Not reportedSUSE-RU-2025:02092-1Not reported
Susepodmanrpmlinux enterprise micro 5.14.9.5-150300.9.49.2Not reportedSUSE-RU-2025:02092-1Not reported
Susepodmanrpmlinux enterprise micro 5.24.9.5-150300.9.49.2Not reportedSUSE-RU-2025:02092-1Not reported
Susepodmanrpmenterprise storage 7.14.9.5-150300.9.49.2Not reportedSUSE-RU-2025:02092-1Not reported
Opensuseteleportrpmtumbleweed15.4.7-1.1Not reportedOPENSUSE-SU-2024:14105-1Not reported
Susepodmanrpmlinux enterprise micro 5.54.9.5-150500.3.18.1Not reportedSUSE-SU-2024:3546-1Not reported
Susepodmanrpmlinux enterprise module for containers 15 sp54.9.5-150500.3.18.1Not reportedSUSE-SU-2024:3546-1Not reported
Susepodmanrpmlinux enterprise module for containers 15 sp64.9.5-150500.3.18.1Not reportedSUSE-SU-2024:3546-1Not reported
Opensusepodmanrpmleap micro 5.54.9.5-150500.3.18.1Not reportedSUSE-SU-2024:3546-1Not reported
Opensusepodmanrpmleap 15.54.9.5-150500.3.18.1Not reportedSUSE-SU-2024:3546-1Not reported
Opensusepodmanrpmleap 15.64.9.5-150500.3.18.1Not reportedSUSE-SU-2024:3546-1Not reported
Suseghrpmpackage hub 15 sp52.53.0-bp155.2.12.1Not reportedOPENSUSE-SU-2024:0227-1Not reported
Opensuseghrpmleap 15.52.53.0-bp155.2.12.1Not reportedOPENSUSE-SU-2024:0227-1Not reported
Opensusepodmanrpmtumbleweed5.1.1-2.1Not reportedOPENSUSE-SU-2024:14102-1Not reported
Susepodmanrpmlinux enterprise micro 5.34.9.5-150400.4.30.1Not reportedSUSE-SU-2024:2273-1Not reported
Susepodmanrpmlinux enterprise micro 5.44.9.5-150400.4.30.1Not reportedSUSE-SU-2024:2273-1Not reported
Susepodmanrpmlinux enterprise high performance computing 15 sp3-ltss4.9.5-150300.9.46.1Not reportedSUSE-SU-2025:1036-1Not reported
Susepodmanrpmlinux enterprise server 15 sp3-ltss4.9.5-150300.9.46.1Not reportedSUSE-SU-2025:1036-1Not reported
Susepodmanrpmlinux enterprise server for sap applications 15 sp34.9.5-150300.9.46.1Not reportedSUSE-SU-2025:1036-1Not reported
Susepodmanrpmlinux enterprise micro 5.14.9.5-150300.9.46.1Not reportedSUSE-SU-2025:1036-1Not reported
Susepodmanrpmlinux enterprise micro 5.24.9.5-150300.9.46.1Not reportedSUSE-SU-2025:1036-1Not reported
Susepodmanrpmenterprise storage 7.14.9.5-150300.9.46.1Not reportedSUSE-SU-2025:1036-1Not reported
Susepodmanrpmlinux enterprise micro 5.54.9.5-150500.3.43.2Not reportedSUSE-RU-2025:02093-1Not reported
Susepodmanrpmlinux enterprise module for containers 15 sp64.9.5-150500.3.43.2Not reportedSUSE-RU-2025:02093-1Not reported
Susepodmanrpmlinux enterprise module for containers 15 sp74.9.5-150500.3.43.2Not reportedSUSE-RU-2025:02093-1Not reported
Susepodmanrpmlinux enterprise high performance computing 15 sp5-espos4.9.5-150500.3.43.2Not reportedSUSE-RU-2025:02093-1Not reported
Susepodmanrpmlinux enterprise high performance computing 15 sp5-ltss4.9.5-150500.3.43.2Not reportedSUSE-RU-2025:02093-1Not reported
Susepodmanrpmlinux enterprise server 15 sp5-ltss4.9.5-150500.3.43.2Not reportedSUSE-RU-2025:02093-1Not reported
Susepodmanrpmlinux enterprise server for sap applications 15 sp54.9.5-150500.3.43.2Not reportedSUSE-RU-2025:02093-1Not reported
Opensusepodmanrpmleap 15.64.9.5-150500.3.43.2Not reportedSUSE-RU-2025:02093-1Not reported
Suseghrpmpackage hub 15 sp62.53.0-bp156.2.6.1Not reportedOPENSUSE-SU-2024:0226-1Not reported
Opensuseghrpmleap 15.62.53.0-bp156.2.6.1Not reportedOPENSUSE-SU-2024:0226-1Not reported
Susepodmanrpmlinux enterprise micro 5.54.9.5-150500.3.40.1Not reportedSUSE-SU-2025:1038-1Not reported
Susepodmanrpmlinux enterprise module for containers 15 sp64.9.5-150500.3.40.1Not reportedSUSE-SU-2025:1038-1Not reported
Susepodmanrpmlinux enterprise high performance computing 15 sp5-espos4.9.5-150500.3.40.1Not reportedSUSE-SU-2025:1038-1Not reported
Susepodmanrpmlinux enterprise high performance computing 15 sp5-ltss4.9.5-150500.3.40.1Not reportedSUSE-SU-2025:1038-1Not reported
Susepodmanrpmlinux enterprise server 15 sp5-ltss4.9.5-150500.3.40.1Not reportedSUSE-SU-2025:1038-1Not reported
Susepodmanrpmlinux enterprise server for sap applications 15 sp54.9.5-150500.3.40.1Not reportedSUSE-SU-2025:1038-1Not reported
Opensusepodmanrpmleap 15.64.9.5-150500.3.40.1Not reportedSUSE-SU-2025:1038-1Not reported
Opensuseghrpmtumbleweed2.53.0-1.1Not reportedOPENSUSE-SU-2024:14211-1Not reported
Susepodmanrpmlinux enterprise micro 5.14.9.5-150300.9.34.1Not reportedSUSE-SU-2024:3062-1Not reported
Susepodmanrpmlinux enterprise micro 5.24.9.5-150300.9.34.1Not reportedSUSE-SU-2024:3062-1Not reported
Susepodmanrpmenterprise storage 7.14.9.5-150300.9.34.1Not reportedSUSE-SU-2024:3062-1Not reported
Susepodmanrpmlinux enterprise micro 5.34.9.5-150400.4.30.1Not reportedSUSE-SU-2024:2273-2Not reported
Susepodmanrpmlinux enterprise micro 5.44.9.5-150400.4.30.1Not reportedSUSE-SU-2024:2273-2Not reported

[Debian bug #1076773]

Notes

[trixie] golang-github-hashicorp-go-retryablehttp: Minor issue [bookworm] golang-github-hashicorp-go-retryablehttp: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [golang-github-hashicorp-go-retryablehttp]

    Details (2)
    • 0.7.1-1 · all · bookworm

      Affected

      dsa · golang-github-hashicorp-go-retryablehttp · debian · bookworm; dsa · golang-github-hashicorp-go-retryablehttp · debian · 12

    • 0.7.1-1 · all · bookworm

      Affected

      dsa · golang-github-hashicorp-go-retryablehttp · debian · bookworm; dsa · golang-github-hashicorp-go-retryablehttp · debian · 12

[Debian 13 (Trixie)]

[openSUSE Tumbleweed]

  • Source package: [gh]

    Details (1)
    • 2.98.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 2.53.0-1.1

      Version impact unknown

      dsa · gh · opensuse · tumbleweed

  • Source package: [gh]

    Details (1)
    • 2.98.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 2.53.0-1.1

      Version impact unknown

      dsa · gh · opensuse · tumbleweed

  • Source package: [gh]

    Details (1)
    • 2.98.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 2.53.0-1.1

      Version impact unknown

      dsa · gh · opensuse · tumbleweed

  • [podman-docker]Unknown

    Source package: [podman]

    Details (1)
    • 6.0.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 5.1.1-2.1

      Version impact unknown

      dsa · podman · opensuse · tumbleweed

  • [podman-remote]Unknown

    Source package: [podman]

    Details (1)
    • 6.0.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1.1-2.1

      Version impact unknown

      dsa · podman · opensuse · tumbleweed

  • [podmansh]Unknown

    Source package: [podman]

    Details (1)
    • 6.0.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1.1-2.1

      Version impact unknown

      dsa · podman · opensuse · tumbleweed

  • Source package: [teleport]

    Details (1)
    • 17.7.26-1.3 · noarch · tumbleweed

      Unknown · Fixed: 15.4.7-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • Source package: [teleport]

    Details (1)
    • 17.7.26-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 15.4.7-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • [teleport-tbot]Unknown

    Source package: [teleport]

    Details (1)
    • 17.7.26-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 15.4.7-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • Source package: [teleport]

    Details (1)
    • 17.7.26-1.3 · noarch · tumbleweed

      Unknown · Fixed: 15.4.7-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • Source package: [teleport]

    Details (1)
    • 17.7.26-1.3 · noarch · tumbleweed

      Unknown · Fixed: 15.4.7-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • [teleport-tctl]Unknown

    Source package: [teleport]

    Details (1)
    • 17.7.26-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 15.4.7-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • Source package: [teleport]

    Details (1)
    • 17.7.26-1.3 · noarch · tumbleweed

      Unknown · Fixed: 15.4.7-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • Source package: [teleport]

    Details (1)
    • 17.7.26-1.3 · noarch · tumbleweed

      Unknown · Fixed: 15.4.7-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • [teleport-tsh]Unknown

    Source package: [teleport]

    Details (1)
    • 17.7.26-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 15.4.7-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • Source package: [teleport]

    Details (1)
    • 17.7.26-1.3 · noarch · tumbleweed

      Unknown · Fixed: 15.4.7-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • Source package: [teleport]

    Details (1)
    • 17.7.26-1.3 · noarch · tumbleweed

      Unknown · Fixed: 15.4.7-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • Source package: [teleport]

    Details (1)
    • 17.7.26-1.3 · noarch · tumbleweed

      Unknown · Fixed: 15.4.7-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]