GHSA-xr7q-jx4m-x55m: Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go

1. GitHub Advisory Database
2. GitHub Reviewed
3. GHSA-xr7q-jx4m-x55m

Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go

Low severity GitHub Reviewed Published Jul 3, 2024 in grpc/grpc-go • Updated Jul 5, 2024

Package

gomod github.com/grpc/grpc-go (Go)

Affected versions

= 1.64.0

Impact

This issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information.

Patches

The issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0

Workarounds

If using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.

References

• GHSA-xr7q-jx4m-x55m

Published to the GitHub Advisory Database

Jul 5, 2024