GHSA-xr7q-jx4m-x55m Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go
Private tokens may be exposed in logs if gRPC metadata contexts are printed, requiring developers to upgrade the Go gRPC library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-xr7q-jx4m-x55m?
GHSA-xr7q-jx4m-x55m is a vulnerability in google.golang.org/grpc, published on 5 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
This issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information.
Patches
The issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0
Workarounds
If using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.
Which versions are affected by GHSA-xr7q-jx4m-x55m?
3 open source packages ship an affected version, including google.golang.org/grpc.
| Package | Affected | Fixed in |
|---|---|---|
google.golang.org/grpc Go | From 1.64.0 | 1.64.1 |
google.golang.org/grpc Go | From 1.64.0 | 1.64.1 |
google.golang.org/grpc Go | From 1.64.0 | 1.64.1 |
How do I fix GHSA-xr7q-jx4m-x55m?
Upgrade google.golang.org/grpc to 1.64.1 or later.
Is GHSA-xr7q-jx4m-x55m being exploited?
There is no known exploitation of GHSA-xr7q-jx4m-x55m in the wild and no public exploit code.
Sources
Also known as GO-2024-2978.