Description
In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`, etc.) is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the `master`+ `develop` branches of the `easybuild-framework` repository.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| easybuilders | easybuild-framework | < 4.1.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | easybuild | < 4.1.2 | 4.1.2 | PYSEC-2020-268 |
| PyPI | easybuild-framework | < 4.1.2 | 4.1.2 | GHSA-2wx6-wc87-rmjm |