HIGH7.5

GHSA-vrmr-f2qh-3hhf

Improper use of cryptographic key in wal-g

Quick fix

GHSA-vrmr-f2qh-3hhf — github.com/wal-g/wal-g: upgrade to the fixed version with the command below.

go get github.com/wal-g/wal-g@v1.1

Details

WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity."

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/wal-g/wal-g

Introduced in: 0Fixed in: 1.1

Fixgo get github.com/wal-g/wal-g@v1.1

References

https://nvd.nist.gov/vuln/detail/CVE-2021-38599[ADVISORY]
https://github.com/wal-g/wal-g/pull/1062[WEB]
https://github.com/wal-g/wal-g/commit/cadf598e1c2a345915a21a44518c5a4d5401e2e3[WEB]
https://github.com/wal-g/wal-g[PACKAGE]
https://github.com/wal-g/wal-g/releases/tag/v1.1[WEB]