CVE-2021-38599

    Dashboard / Vulnerabilities / CVE-2021-38599

    CVE-2021-38599

    Published: 12 Aug 2021Last Modified: 9 Jul 2026

    Summary:

    Details: WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity."

    References: https://github.com/wal-g/wal-g/commit/cadf598e1c2a345915a21a44518c5a4d5401e2e3, https://github.com/wal-g/wal-g/pull/1062

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -cadf598e1c2a345915a21a44518c5a4d5401e2e3

    Affected versions

    v1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-38599 | CVE-DB