CVE-2021-38599: Improper use of cryptographic key in wal-g
Summary
CVE-2021-38599: Improper use of cryptographic key in wal-g. Affects github.com/wal-g/wal-g versions < 1.1. Fixed in 1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wal-g package is a Go library that provides utilities for working with Write-Ahead Logs (WAL) in PostgreSQL databases. It offers features such as backup and restore functionality, compression, and encryption. The package is widely used in the Go ecosystem for managing PostgreSQL backups. However, versions prior to 1.1 of wal-g have a vulnerability that allows cleartext backups to be uploaded when a non-libsodium build is used, disregarding the libsodium encryption key. This violates the Principle of Least Surprise as users would expect all file activity to be encrypted.
Vulnerability Detail
The vulnerability in wal-g arises from improper use of the cryptographic key. When a non-libsodium build is used, the package fails to properly handle the encryption key and uploads backups in cleartext instead of encrypting them. This can lead to unauthorized access to sensitive data if the backups are intercepted or accessed by malicious actors. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.1
This is the first release that contains the fix.
go get github.com/wal-g/wal-g@v1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that they are using a libsodium build of the wal-g package and by updating to version 1.1 or later.
Conclusion
The wal-g package prior to version 1.1 has a vulnerability that allows cleartext backups to be uploaded when a non-libsodium build is used. This can result in unauthorized access to sensitive data. To mitigate the risk, users should update to version 1.1 or later and ensure they are using a libsodium build. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/wal-g/wal-g →
FAQ
wal-g is a Go library for working with Write-Ahead Logs (WAL) in PostgreSQL databases. It provides backup and restore functionality, compression, and encryption features.
The vulnerability allows cleartext backups to be uploaded when a non-libsodium build of wal-g is used, bypassing encryption. This can lead to unauthorized access to sensitive data.
To fix the vulnerability, update to version 1.1 or later of the wal-g package and ensure that you are using a libsodium build.
There is no specific workaround mentioned for this vulnerability. However, using a libsodium build and updating to version 1.1 or later can mitigate the risk.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
