`SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed
CVE-2023-46255

4.2MEDIUM

Key Information:

Vendor

Authzed

Status
Spicedb
Vendor
CVE Published:
31 October 2023

What is CVE-2023-46255?

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains :) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.

Affected Version(s)

spicedb < 1.27.0-rc1

References

https://github.com/authzed/spicedb/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/authzed/spicedb/commit/ae50421b80f895e...
x_refsource_MISC

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.