GHSA-xr7q-jx4m-x55m GO-2024-2978
Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go
- Severity
- Low
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- Fix
1.64.1- Upgrade google.golang.org/grpc to this version or later
Description
Impact
This issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information.
Patches
The issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0
Workarounds
If using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| google.golang.org/grpc | >= 1.64.0, < 1.64.1 |
1.64.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
google.golang.org/grpc Go → 1.64.1
- go
go get google.golang.org/grpc@v1.64.1 && go mod tidy
Weakness
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-m425-mq94-257g gRPC-Go HTTP/2 Rapid Reset vulnerability | High Known exploited | Also affects google.golang.org/grpc |
| GHSA-2v4p-qf9q-27wj gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers | High | Also affects google.golang.org/grpc |
| GHSA-vp52-pcj8-j9qc gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation | High | Also affects google.golang.org/grpc |
| GHSA-qc2q-p7wx-3px3 gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion | Medium | Also affects google.golang.org/grpc |
| GHSA-hrxh-6v49-42gf gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities | High | Also affects google.golang.org/grpc |
| GHSA-p77j-4mvh-x3m3 gRPC-Go has an authorization bypass via missing leading slash in :path | Critical | Also affects google.golang.org/grpc |
| GHSA-j7qq-vr8c-xvw3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans | Medium | Same weakness, CWE-200 |
| GHSA-gqh3-7856-rjjg ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure) | Medium | Same weakness, CWE-200 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor