CVE-2023-45825 json
Token in custom credentials object can leak through logs in ydb-go-sdk
published 2023-10-19 3 y ago modified 2026-09-10 1 mo ago also GHSA-q24m-6h38-5xj8 , GO-2023-2137 , EUVD-2023-2791
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 14%
- public exploits
- 0
- none known
Summary
ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object (implementation of interface Credentials it may leak into logs. This happens because this object could be serialized into an error message using `fmt.Errorf("something went wrong (credentials: %q)", credentials)` during connection to the YDB server. If such logging occurred, a malicious user with access to logs could read sensitive information (i.e. credentials) information and use it to get access to the database. ydb-go-sdk contains this problem in versions from v3.48.6 to v3.53.2. The fix for this problem has been released in version v3.53.3. Users are advised to upgrade. Users unable to upgrade should implement the `fmt.Stringer` interface in your custom credentials type with explicit stringify of object state.
Patch / fix
- go github.com/ydb-platform/ydb-go-sdk/v3 3.53.3
- ydb ydb-go-sdk 3.53.2
- github.com/ydb-platform/ydb-go-sdk@a0d9205 commit
- github.com/ydb-platform/ydb-go-sdk#859 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.23% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/ydb-platform/ydb-go-sdk/v3 | >=3.48.6, <3.53.3 |
3.53.3 |
Affected products
- ydb-platform ydb-go-sdk
Classification
- Weakness
-
- CWE-532 Insertion of Sensitive Information into Log File
References
-
github.com
/ydb-platform/ydb-go-sdk/pull/859
web, issue-tracking, patch
-
github.com
/ydb-platform/ydb-go-sdk/commit/a0d92057c4e1bbdc5e85ae8d649edb0232b8fd4c
web, patch
-
github.com
/ydb-platform/ydb-go-sdk/security/advisories/GHSA-q24m-6h38-5xj8
web, vendor-advisory, advisory
-
github.com
/ydb-platform/ydb-go-sdk/blob/master/credentials/credentials.go#L10
web, product
-
github.com
/ydb-platform/ydb-go-sdk/blob/v3.48.6/internal/balancer/balancer.go#L71
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2023-45825
advisory
-
github.com
/ydb-platform/ydb-go-sdk
package
Sources
- CVE List CVE-2023-45825
- GitHub Advisory GHSA-q24m-6h38-5xj8
- NVD CVE-2023-45825
- OSV GO-2023-2137
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.