GO-2023-2137
Dashboard / Vulnerabilities / GO-2023-2137
GO-2023-2137
Published: 24 Oct 2023Last Modified: 20 May 2024
Aliases:
Summary: Credentials leak in github.com/ydb-platform/ydb-go-sdk/v3
Details: A custom credentials object that does not implement the fmt.Stringer interface may leak sensitive information (e.g., credentials) via logs.
References: https://github.com/ydb-platform/ydb-go-sdk/security/advisories/GHSA-q24m-6h38-5xj8, https://github.com/ydb-platform/ydb-go-sdk/pull/859, https://github.com/ydb-platform/ydb-go-sdk/commit/a0d92057c4e1bbdc5e85ae8d649edb0232b8fd4c
Affected packages
Package
Name: github.com/ydb-platform/ydb-go-sdk/v3
Purl: pkg:golang/github.com/ydb-platform/ydb-go-sdk/v3
Affected ranges
Type: SEMVER
Events:
Introduced- 3.48.6
Fixed -3.53.3
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
