GitHub Advisoryadvisory · Go

GHSA-xr7q-jx4m-x55m Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go

LOW Published 2024-07-05 Modified 2024-07-09 Official page ↗
Ecosystem
Go
Packages
google.golang.org/grpc
Severity
Low
Weaknesses
CWE-200
Reviewed
2024-07-05

Affected packages

• Go google.golang.org/grpc: >= 1.64.0, < 1.64.1 → fixed in 1.64.1

Description

Impact This issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information. Patches The issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0 Workarounds If using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References