GitHub Advisoryadvisory · Go

GHSA-jg7w-cxjv-98c2 SpiceDB leaks information in log files when URI cannot be parsed

MEDIUM Published 2023-10-31 Modified 2023-11-03 Official page ↗
Aliases
CVE-2023-46255
Ecosystem
Go
Packages
github.com/authzed/spicedb
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2023-10-31

Affected packages

• Go github.com/authzed/spicedb: < 1.27.0-rc1 → fixed in 1.27.0-rc1

Description

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. When the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue. Example output: ``` terminated with errors error="unable to create migration driver for postgres: parse \"postgres://spicedb:": invalid port \"\" after host" ```

Related

Alias · CVE (1)

  • CVE-2023-46255 SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References