Vulnerability · Published Oct 31, 2023 · Assigned by GitHub_M
CVE-2023-46255`SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed
Medium 4.2
In plain English
A medium-severity sensitive data in logs in spicedb from authzed. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/authzed/spicedb | 1.27.0-rc1 | GO-2023-2166 |
| Go | github.com/authzed/spicedb | 1.27.0-rc1 | GHSA-jg7w-cxjv-98c2 |
Affected products (as reported)
Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N