AIKIDO-2024-10441
vaultrs is vulnerable to Insertion of Sensitive Information into Log File
47
Medium Risk
This Affects:
vaultrsTL;DR
Affected versions of this package may leak the unseal key in the logs. The unseal key is inadvertently logged when the /sys/unseal endpoint is accessed. This presents a significant security risk, as the key could end up in system logs, potentially written to disk due to swap mechanisms. Additionally, users may unknowingly transmit their unseal key to remote log servers if logging is misconfigured, further compromising security. It is essential to ensure that sensitive information like the unseal key is excluded from logs and to review log configuration to prevent accidental exposure.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
vaultrs is vulnerable to Insertion of Sensitive Information into Log File in versions 0.5.1 - 0.7.2.
How to fix this
Upgrade the vaultrs library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant