LOW

GHSA-xr7q-jx4m-x55m

Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go

Quick fix

GHSA-xr7q-jx4m-x55m — google.golang.org/grpc: upgrade to the fixed version with the command below.

go get google.golang.org/grpc@v1.64.1

Details

### Impact This issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information.

### Patches The issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0

### Workarounds If using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/google.golang.org/grpc

Introduced in: 1.64.0Fixed in: 1.64.1

Fixgo get google.golang.org/grpc@v1.64.1

References

https://github.com/grpc/grpc-go/security/advisories/GHSA-xr7q-jx4m-x55m[WEB]
https://github.com/grpc/grpc-go/commit/ab292411ddc0f3b7a7786754d1fe05264c3021eb[WEB]
https://github.com/grpc/grpc-go[PACKAGE]