# GHSA-xr7q-jx4m-x55m: Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go

> Private tokens may be exposed in logs if gRPC metadata contexts are printed, requiring developers to upgrade the Go gRPC library.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 5 Jul 2024
- **Also known as:** GO-2024-2978

## What is GHSA-xr7q-jx4m-x55m?

GHSA-xr7q-jx4m-x55m is a vulnerability in google.golang.org/grpc, published on 5 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

### Impact
This issue represents a potential PII concern.  If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information.

### Patches
The issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0

### Workarounds
If using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.

## Which versions are affected by GHSA-xr7q-jx4m-x55m?

3 open source packages ship an affected version, including google.golang.org/grpc.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `google.golang.org/grpc` | Go | From 1.64.0 | 1.64.1 |
| `google.golang.org/grpc` | Go | From 1.64.0 | 1.64.1 |
| `google.golang.org/grpc` | Go | From 1.64.0 | 1.64.1 |

## How do I fix GHSA-xr7q-jx4m-x55m?

Upgrade google.golang.org/grpc to 1.64.1 or later.

## Is GHSA-xr7q-jx4m-x55m being exploited?

There is no known exploitation of GHSA-xr7q-jx4m-x55m in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-xr7q-jx4m-x55m and fix it if it is affected.

What it is: GHSA-xr7q-jx4m-x55m is a vulnerability in google.golang.org/grpc, published on 5 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-xr7q-jx4m-x55m in the wild and no public exploit code.

Affected packages and fixed versions:
- google.golang.org/grpc (Go): affected from 1.64.0; fixed in 1.64.1
- google.golang.org/grpc (Go): affected from 1.64.0; fixed in 1.64.1
- google.golang.org/grpc (Go): affected from 1.64.0; fixed in 1.64.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-xr7q-jx4m-x55m/ (Markdown: https://insights.sbomify.com/GHSA-xr7q-jx4m-x55m/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-xr7q-jx4m-x55m

---
From sbomify Insights: https://insights.sbomify.com/GHSA-xr7q-jx4m-x55m/
Summaries are generated and may contain mistakes; the official description above is the record.