GHSA-jg7w-cxjv-98c2
SpiceDB leaks information in log files when URI cannot be parsed
Quick fix
GHSA-jg7w-cxjv-98c2 — github.com/authzed/spicedb: upgrade to the fixed version with the command below.
go get github.com/authzed/spicedb@v1.27.0-rc1Details
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. When the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.
Example output: ``` terminated with errors error="unable to create migration driver for postgres: parse \"postgres://spicedb:<PASSWORD IN PLAINTEXT>": invalid port \"<PASSWORD IN PLAINTEXT>\" after host" ```
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 1.27.0-rc1go get github.com/authzed/spicedb@v1.27.0-rc1