Acme.sh Docker Image Credential Persistence Vulnerability

A vulnerability exists in the Docker image from acme.sh, prior to the commit 40b6db6, which is based on a workflow file for GitHub Actions. The vulnerability arises because the workflow file does not include the 'persist-credentials: false' option for the actions/checkout step. This omission can lead to unintended credential persistence, potentially allowing for credential leakage or misuse.

Impact

The lack of proper credential management can lead to unauthorized access or manipulation of resources, as credentials may be inadvertently exposed or retained longer than necessary.

Remediation

Users can update to the acme.sh Docker image version that includes the necessary credential management. Instructions for building the Docker image with the correct configuration are available in the acme.sh repository.