CVE-2023-46255: Insertion of Sensitive Information into Log File

October 31, 2023

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0, when the provided datastore URI is malformed (e.g. by having a password which contains :) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0 patches this issue.

References

github.com/advisories/GHSA-jg7w-cxjv-98c2
github.com/authzed/spicedb/commit/ae50421b80f895e4c98d999b18e06b6f1e6f1cf8
github.com/authzed/spicedb/security/advisories/GHSA-jg7w-cxjv-98c2
nvd.nist.gov/vuln/detail/CVE-2023-46255

Code Behaviors & Features

Detect and mitigate CVE-2023-46255 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →