{"answers":{"affected":"3 open source packages ship an affected version, including google.golang.org/grpc.","exploited":"There is no known exploitation of GHSA-xr7q-jx4m-x55m in the wild and no public exploit code.","fix":"Upgrade google.golang.org/grpc to 1.64.1 or later.","what":"GHSA-xr7q-jx4m-x55m is a vulnerability in google.golang.org/grpc, published on 5 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-xr7q-jx4m-x55m and fix it if it is affected.\n\nWhat it is: GHSA-xr7q-jx4m-x55m is a vulnerability in google.golang.org/grpc, published on 5 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-xr7q-jx4m-x55m in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- google.golang.org/grpc (Go): affected from 1.64.0; fixed in 1.64.1\n- google.golang.org/grpc (Go): affected from 1.64.0; fixed in 1.64.1\n- google.golang.org/grpc (Go): affected from 1.64.0; fixed in 1.64.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-xr7q-jx4m-x55m/ (Markdown: https://insights.sbomify.com/GHSA-xr7q-jx4m-x55m/index.md)","id":"GHSA-xr7q-jx4m-x55m","markdown":"https://insights.sbomify.com/GHSA-xr7q-jx4m-x55m/index.md","name":"GHSA-xr7q-jx4m-x55m","record":{"aliases":["GO-2024-2978"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Go gRPC library","requires_auth":"none","summary":"Private tokens may be exposed in logs if gRPC metadata contexts are printed, requiring developers to upgrade the Go gRPC library.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\nThis issue represents a potential PII concern.  If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information.\n\n### Patches\nThe issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0\n\n### Workarounds\nIf using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go","id":"GHSA-xr7q-jx4m-x55m","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"information_disclosure","year":"2024"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["1.64.1"],"introduced":["1.64.0"],"last_affected":[],"package":"google.golang.org/grpc","purl":null,"source":"GHSA-xr7q-jx4m-x55m"},{"ecosystem":"Go","fixed":["1.64.1"],"introduced":["1.64.0"],"last_affected":[],"package":"google.golang.org/grpc","purl":"pkg:golang/google.golang.org/grpc","source":"GHSA-xr7q-jx4m-x55m"},{"ecosystem":"Go","fixed":["1.64.1"],"introduced":["1.64.0"],"last_affected":[],"package":"google.golang.org/grpc","purl":"pkg:golang/google.golang.org/grpc","source":"GO-2024-2978"}],"products":null,"published":"2024-07-05","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Private tokens may be exposed in logs if gRPC metadata contexts are printed, requiring developers to upgrade the Go gRPC library.","url":"https://insights.sbomify.com/GHSA-xr7q-jx4m-x55m/"}