Skip to content

`SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed

Moderate
josephschorr published GHSA-jg7w-cxjv-98c2 Oct 30, 2023

Package

gomod github.com/authzed/spicedb (Go)

Affected versions

<1.27.0-rc1

Patched versions

1.27.0-rc1

Description

Summary

When the provided datastore URI is malformed (e.g. by having a password which contains :) the full URI (including the provided password) is printed, so that the password is shown in the logs.

Example output:

terminated with errors error="unable to create migration driver for postgres: parse \"postgres://spicedb:<PASSWORD IN PLAINTEXT>": invalid port \"<PASSWORD IN PLAINTEXT>\" after host"

Severity

Moderate
4.2
/ 10

CVSS base metrics

Attack vector
Local
Attack complexity
Low
Privileges required
High
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

CVE ID

CVE-2023-46255

Weaknesses

No CWEs

Credits