MEDIUM
GHSA-g3p6-82vc-43jh
Yii 2 Redis may expose AUTH parameters in logs in case of connection failure
Quick fix
GHSA-g3p6-82vc-43jh — yiisoft/yii2-redis: upgrade to the fixed version with the command below.
composer require yiisoft/yii2-redis:^2.0.20Details
### Impact
On failing connection extension writes commands sequence to logs. AUTH parameters are written in plain text exposing username and password. That might be an issue if attacker has access to logs.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/yiisoft/yii2-redis
Introduced in:
0Fixed in: 2.0.20Fix
composer require yiisoft/yii2-redis:^2.0.20