CWE-532
AllowedInsertion of Sensitive Information into Log File
Abstraction: Base · Status: Incomplete
The product writes sensitive information to a log file.
1961 vulnerabilities reference this CWE, most recent first.
GHSA-PRH4-VHFH-24MJ
Vulnerability from github – Published: 2026-03-26 22:25 – Updated: 2026-03-26 22:25Impact
Harbor write configuration payload to audit log when configuration change, the ldap_search_password and oidc_client_secret will be logged in the audit log without redacted
Patches
Harbor v2.15.0, v2.14.3, v2.13.5
Workarounds
Disable audit log configure event in Harbor Web Console: Go to Administration -> Configuration -> Enable Audit Log Event Type -> Uncheck "Update Configuration" and click "Save" Button.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/goharbor/harbor"
},
"ranges": [
{
"events": [
{
"introduced": "2.13.0"
},
{
"fixed": "2.13.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/goharbor/harbor"
},
"ranges": [
{
"events": [
{
"introduced": "2.14.0"
},
{
"fixed": "2.14.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-26T22:25:26Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\nHarbor write configuration payload to audit log when configuration change, the ldap_search_password and oidc_client_secret will be logged in the audit log without redacted\n\n### Patches\nHarbor v2.15.0, v2.14.3, v2.13.5\n\n### Workarounds\nDisable audit log configure event in Harbor Web Console: Go to Administration -\u003e Configuration -\u003e Enable Audit Log Event Type -\u003e Uncheck \"Update Configuration\" and click \"Save\" Button.",
"id": "GHSA-prh4-vhfh-24mj",
"modified": "2026-03-26T22:25:26Z",
"published": "2026-03-26T22:25:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/goharbor/harbor/security/advisories/GHSA-prh4-vhfh-24mj"
},
{
"type": "WEB",
"url": "https://github.com/goharbor/harbor/commit/85e756486fc19333c5c300d7ac273e1580dc9350"
},
{
"type": "PACKAGE",
"url": "https://github.com/goharbor/harbor"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Harbor: LDAP password and OIDC secret are not redacted in the audit log"
}
GHSA-PRRM-FV2R-3VWP
Vulnerability from github – Published: 2022-05-17 00:17 – Updated: 2022-05-17 00:17The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed password by reading the audit log.
{
"affected": [],
"aliases": [
"CVE-2017-16946"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-25T18:29:00Z",
"severity": "MODERATE"
},
"details": "The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed password by reading the audit log.",
"id": "GHSA-prrm-fv2r-3vwp",
"modified": "2022-05-17T00:17:46Z",
"published": "2022-05-17T00:17:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16946"
},
{
"type": "WEB",
"url": "https://github.com/MISP/MISP/commit/7d5890b2fc63285f010d5845913894dd71cf232c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PRVJ-QFJV-3X3F
Vulnerability from github – Published: 2022-07-20 00:00 – Updated: 2022-07-28 00:00Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.
{
"affected": [],
"aliases": [
"CVE-2022-2394"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-19T18:15:00Z",
"severity": "LOW"
},
"details": "Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.",
"id": "GHSA-prvj-qfjv-3x3f",
"modified": "2022-07-28T00:00:43Z",
"published": "2022-07-20T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2394"
},
{
"type": "WEB",
"url": "https://puppet.com/security/cve/CVE-2022-2394"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PWJC-PM2Q-CPG2
Vulnerability from github – Published: 2022-04-29 00:00 – Updated: 2022-05-07 00:00cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file.
{
"affected": [],
"aliases": [
"CVE-2022-29869"
],
"database_specific": {
"cwe_ids": [
"CWE-532",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-28T01:15:00Z",
"severity": "MODERATE"
},
"details": "cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file.",
"id": "GHSA-pwjc-pm2q-cpg2",
"modified": "2022-05-07T00:00:56Z",
"published": "2022-04-29T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29869"
},
{
"type": "WEB",
"url": "https://github.com/piastry/cifs-utils/pull/7"
},
{
"type": "WEB",
"url": "https://github.com/piastry/cifs-utils/commit/8acc963a2e7e9d63fe1f2e7f73f5a03f83d9c379"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00020.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WBOLMANBYJILXQKRRK7OCR774PXJAYY"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXKZLJYJJEC3TIBFLXUORRMZUKG5W676"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIYZ4L6SLSYJQ446VJAO2VGAESURQNSP"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WBOLMANBYJILXQKRRK7OCR774PXJAYY"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HXKZLJYJJEC3TIBFLXUORRMZUKG5W676"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QIYZ4L6SLSYJQ446VJAO2VGAESURQNSP"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202311-05"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5157"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PWX5-6WXG-PX5H
Vulnerability from github – Published: 2024-03-14 21:17 – Updated: 2024-03-14 21:17Impact
Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block. This unexpected behavior primarily impacts secrets restricted by the "no commands" option. This can lead to unintended use of the secret value, and increased risk of exposing the secret during image execution bypassing log masking.
Given by the following substitution examples:
using parameters
steps:
- name: example
image: <some plugin>
secrets: [ example_secret ]
parameters:
example: $${EXAMPLE_SECRET}
using image tag
steps:
- name: example
image: <some plugin>:latest${EXAMPLE_SECRET}
secrets: [ example_secret ]
using entrypoint as a shim for commands
steps:
- name: example
image: <some plugin>
secrets: [ example_secret ]
entrypoint:
[
"sh",
"-c",
"echo $EXAMPLE_SECRET",
]
To exploit this the pipeline author must be supplying the secrets to a plugin that is designed in such a way that will print those parameters in logs. Plugin parameters are not designed for sensitive values and are often intentionally printed throughout execution for informational/debugging purposes. Parameters should therefore be treated as insensitive.
While Vela provides secrets masking, secrets exposure is not entirely solved by the masking process. A docker image (plugin) can easily expose secrets if they are not handled properly, or altered in some way. There is a responsibility on the end-user to understand how values injected into a plugin are used. This is a risk that exists for many CICD systems (like GitHub Actions) that handle sensitive runtime variables. Rather, the greater risk is that users who restrict a secret to the "no commands" option and use image restriction can still have their secret value exposed via substitution tinkering, which turns the image and command restrictions into a false sense of security.
Patches
N/A
Workarounds
- Do not provide sensitive values to plugins that can potentially expose them, especially in
parametersthat are not intended to be used for sensitive values. - Ensure plugins (especially those that utilize shared secrets) follow best practices to avoid logging parameters that are expected to be sensitive.
- Minimize secrets with
pull_requestevents enabled, as this allows users to change pipeline configurations and pull in secrets to steps not typically part of the CI process. - Make use of the build approval setting, restricting builds from untrusted users
- Limit use of shared secrets, as they are less restrictive to access by nature.
References
- https://github.com/go-vela/worker
For more information
If you have any questions or comments about this advisory:
- Email us at vela@target.com
Affected products: go-vela/worker
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.23.1"
},
"package": {
"ecosystem": "Go",
"name": "github.com/go-vela/worker"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.23.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-28236"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-14T21:17:05Z",
"nvd_published_at": "2024-03-12T21:15:59Z",
"severity": "HIGH"
},
"details": "### Impact\nVela pipelines can use variable substitution combined with insensitive fields like `parameters`, `image` and `entrypoint` to inject secrets into a plugin/image and \u2014 by using common substitution string manipulation \u2014 can bypass log masking and expose secrets without the use of the commands block. This unexpected behavior primarily impacts secrets restricted by the \"no commands\" option. This can lead to unintended use of the secret value, and increased risk of exposing the secret during image execution bypassing log masking.\n\nGiven by the following substitution examples:\nusing `parameters`\n```yaml\nsteps:\n - name: example\n image: \u003csome plugin\u003e\n secrets: [ example_secret ]\n parameters:\n example: $${EXAMPLE_SECRET}\n```\n\nusing `image` tag\n```yaml\nsteps:\n - name: example\n image: \u003csome plugin\u003e:latest${EXAMPLE_SECRET}\n secrets: [ example_secret ]\n```\n\nusing `entrypoint` as a shim for `commands`\n```yaml\nsteps:\n - name: example\n image: \u003csome plugin\u003e\n secrets: [ example_secret ]\n entrypoint:\n [\n \"sh\",\n \"-c\",\n \"echo $EXAMPLE_SECRET\",\n ]\n```\n\n\n\n**To exploit this** the pipeline author must be supplying the secrets to a plugin that is designed in such a way that will print those parameters in logs. Plugin parameters are not designed for sensitive values and are often intentionally printed throughout execution for informational/debugging purposes. Parameters should therefore be treated as insensitive.\n\nWhile Vela provides secrets masking, secrets exposure is not entirely solved by the masking process. A docker image (plugin) can easily expose secrets if they are not handled properly, or altered in some way. There is a responsibility on the end-user to understand how values injected into a plugin are used. This is a risk that exists for many CICD systems (like GitHub Actions) that handle sensitive runtime variables. Rather, the greater risk is that users who restrict a secret to the \"no commands\" option and use image restriction can still have their secret value exposed via substitution tinkering, which turns the image and command restrictions into a false sense of security.\n\n### Patches\nN/A\n\n### Workarounds\n- Do not provide sensitive values to plugins that can potentially expose them, especially in `parameters` that are not intended to be used for sensitive values.\n- Ensure plugins (especially those that utilize shared secrets) follow best practices to avoid logging parameters that are expected to be sensitive.\n- Minimize secrets with `pull_request` events enabled, as this allows users to change pipeline configurations and pull in secrets to steps not typically part of the CI process.\n- Make use of the build approval setting, restricting builds from untrusted users\n- Limit use of shared secrets, as they are less restrictive to access by nature.\n\n### References\n- https://github.com/go-vela/worker\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Email us at [vela@target.com](mailto:vela@target.com)\n\nAffected products: `go-vela/worker`",
"id": "GHSA-pwx5-6wxg-px5h",
"modified": "2024-03-14T21:17:05Z",
"published": "2024-03-14T21:17:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-vela/worker/security/advisories/GHSA-pwx5-6wxg-px5h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28236"
},
{
"type": "WEB",
"url": "https://github.com/go-vela/worker/commit/e1572743b008e4fbce31ebb1dcd23bf6a1a30297"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-vela/worker"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Insecure Variable Substitution in Vela"
}
GHSA-PX9R-XQ3X-JF4F
Vulnerability from github – Published: 2022-05-24 19:12 – Updated: 2022-05-24 19:12The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can read any log file resulting in sensitive information disclosure.
{
"affected": [],
"aliases": [
"CVE-2021-22024"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-30T18:15:00Z",
"severity": "HIGH"
},
"details": "The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can read any log file resulting in sensitive information disclosure.",
"id": "GHSA-px9r-xq3x-jf4f",
"modified": "2022-05-24T19:12:29Z",
"published": "2022-05-24T19:12:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22024"
},
{
"type": "WEB",
"url": "https://www.vmware.com/security/advisories/VMSA-2021-0018.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PXV2-R799-MJ6C
Vulnerability from github – Published: 2025-06-16 18:32 – Updated: 2025-06-16 18:32A flaw exists in FlashArray whereby the Key Encryption Key (KEK) is logged during key rotation when RDL is configured.
{
"affected": [],
"aliases": [
"CVE-2025-2327"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-16T17:15:28Z",
"severity": "MODERATE"
},
"details": "A flaw exists in FlashArray whereby the Key Encryption Key (KEK) is logged during key rotation when RDL is configured.",
"id": "GHSA-pxv2-r799-mj6c",
"modified": "2025-06-16T18:32:19Z",
"published": "2025-06-16T18:32:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2327"
},
{
"type": "WEB",
"url": "https://support.purestorage.com/category/m_pure_storage_product_security"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PXX3-8XW2-8X5X
Vulnerability from github – Published: 2024-04-18 12:30 – Updated: 2026-04-28 21:34Insertion of Sensitive Information into Log File vulnerability in Inisev Backup Migration.This issue affects Backup Migration: from n/a through 1.4.3.
{
"affected": [],
"aliases": [
"CVE-2024-32686"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-18T11:15:38Z",
"severity": "MODERATE"
},
"details": "Insertion of Sensitive Information into Log File vulnerability in Inisev Backup Migration.This issue affects Backup Migration: from n/a through 1.4.3.",
"id": "GHSA-pxx3-8xw2-8x5x",
"modified": "2026-04-28T21:34:51Z",
"published": "2024-04-18T12:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32686"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/backup-backup/wordpress-backup-migration-plugin-1-4-3-sensitive-data-exposure-via-log-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PXXX-P822-7V7M
Vulnerability from github – Published: 2022-05-24 17:30 – Updated: 2022-05-24 17:30A log information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to view log information reserved for other users.
{
"affected": [],
"aliases": [
"CVE-2020-11646"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-15T15:15:00Z",
"severity": "MODERATE"
},
"details": "A log information disclosure vulnerability in B\u0026R GateManager 4260 and 9250 versions \u003c9.0.20262 and GateManager 8250 versions \u003c9.2.620236042 allows authenticated users to view log information reserved for other users.",
"id": "GHSA-pxxx-p822-7v7m",
"modified": "2022-05-24T17:30:43Z",
"published": "2022-05-24T17:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11646"
},
{
"type": "WEB",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03"
},
{
"type": "WEB",
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1600003183751-de-original-1.0.pdf"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-Q24M-6H38-5XJ8
Vulnerability from github – Published: 2023-10-19 17:10 – Updated: 2023-10-24 22:48Impact
Since ydb-go-sdk/v3.48.6 if you use a custom credentials object (implementation of interface Credentials) it may leak into logs. This happens because this object could be serialized into an error message using fmt.Errorf("something went wrong (credentials: %q)", credentials) during connection to the YDB server. Printf func use placeholder %q for string representation of argument with quotes. If an argument implements interface fmt.Stringer, it will used through String() func. In other cases used fallback - serialization with reflection.
If such logging occurred, a malicious user with access to logs could read sensitive information (i.e. credentials) information and use it to get access to the database.
Who is impacted: applications with custom credentials object with an explicit token field.
A leak could have occurred if all of these conditions were met simultaneously:
1) The credentials object does not implement the fmt.Stringer interface (does not have a String() method) - potentially these are custom credentials. Official credentials have a String() method.
2) There was an error connecting to YDB during driver creation via ydb.Open(...).
3) Some logging system was configured (ydb-go-sdk does not log such errors by default).
4) The connection error was logged into a system that a malicious user had access to.
Patches
ydb-go-sdk contains this problem in versions from v3.48.6 to v3.53.2. The fix for this problem has been released in version v3.53.3 (PR).
Workarounds
Implement the fmt.Stringer interface in your custom credentials type with explicit stringify of object state.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/ydb-platform/ydb-go-sdk/v3"
},
"ranges": [
{
"events": [
{
"introduced": "3.48.6"
},
{
"fixed": "3.53.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-45825"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-19T17:10:00Z",
"nvd_published_at": "2023-10-19T19:15:16Z",
"severity": "MODERATE"
},
"details": "### Impact\nSince [ydb-go-sdk/v3.48.6](https://github.com/ydb-platform/ydb-go-sdk/blob/v3.48.6/internal/balancer/balancer.go#L71) if you use a custom credentials object (implementation of interface [Credentials](https://github.com/ydb-platform/ydb-go-sdk/blob/master/credentials/credentials.go#L10)) it may leak into logs. This happens because this object could be serialized into an error message using `fmt.Errorf(\"something went wrong (credentials: %q)\", credentials)` during connection to the YDB server. Printf func use placeholder `%q` for string representation of argument with quotes. If an argument implements interface `fmt.Stringer`, it will used through `String()` func. In other cases used fallback - serialization with reflection.\n\nIf such logging occurred, a malicious user with access to logs could read sensitive information (i.e. credentials) information and use it to get access to the database.\n\nWho is impacted: applications with custom credentials object with an explicit token field.\n\nA leak could have occurred if all of these conditions were met simultaneously:\n1) The credentials object does not implement the `fmt.Stringer` interface (does not have a `String()` method) - potentially these are custom credentials. Official credentials have a `String()` method.\n2) There was an error connecting to YDB during driver creation via `ydb.Open(...)`.\n3) Some logging system was configured (`ydb-go-sdk` does not log such errors by default).\n4) The connection error was logged into a system that a malicious user had access to.\n\n### Patches\n`ydb-go-sdk` contains this problem in versions from v3.48.6 to v3.53.2. The fix for this problem has been released in version v3.53.3 ([PR](https://github.com/ydb-platform/ydb-go-sdk/pull/859)).\n\n### Workarounds\nImplement the `fmt.Stringer` interface in your custom credentials type with explicit stringify of object state.",
"id": "GHSA-q24m-6h38-5xj8",
"modified": "2023-10-24T22:48:40Z",
"published": "2023-10-19T17:10:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ydb-platform/ydb-go-sdk/security/advisories/GHSA-q24m-6h38-5xj8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45825"
},
{
"type": "WEB",
"url": "https://github.com/ydb-platform/ydb-go-sdk/pull/859"
},
{
"type": "WEB",
"url": "https://github.com/ydb-platform/ydb-go-sdk/commit/a0d92057c4e1bbdc5e85ae8d649edb0232b8fd4c"
},
{
"type": "PACKAGE",
"url": "https://github.com/ydb-platform/ydb-go-sdk"
},
{
"type": "WEB",
"url": "https://github.com/ydb-platform/ydb-go-sdk/blob/master/credentials/credentials.go#L10"
},
{
"type": "WEB",
"url": "https://github.com/ydb-platform/ydb-go-sdk/blob/v3.48.6/internal/balancer/balancer.go#L71"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "ydb-go-sdk token in custom credentials object can leak through logs"
}
Mitigation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Mitigation
Remove debug log files before deploying the application into production.
Mitigation
Protect log files against unauthorized read/write.
Mitigation
Adjust configurations appropriately when software is transitioned from a debug state to production.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.