WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity."
References
| Link | Resource |
|---|---|
| https://github.com/wal-g/wal-g/commit/cadf598e1c2a345915a21a44518c5a4d5401e2e3 | Patch Third Party Advisory |
| https://github.com/wal-g/wal-g/pull/1062 | Patch Third Party Advisory |
| https://github.com/wal-g/wal-g/commit/cadf598e1c2a345915a21a44518c5a4d5401e2e3 | Patch Third Party Advisory |
| https://github.com/wal-g/wal-g/pull/1062 | Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 06:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/wal-g/wal-g/commit/cadf598e1c2a345915a21a44518c5a4d5401e2e3 - Patch, Third Party Advisory | |
| References | () https://github.com/wal-g/wal-g/pull/1062 - Patch, Third Party Advisory |
12 Jul 2022, 17:42
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-754 |
23 Aug 2021, 16:41
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| CWE | CWE-922 | |
| CPE | cpe:2.3:a:wal-g_project:wal-g:*:*:*:*:*:*:*:* | |
| References | (MISC) https://github.com/wal-g/wal-g/commit/cadf598e1c2a345915a21a44518c5a4d5401e2e3 - Patch, Third Party Advisory | |
| References | (MISC) https://github.com/wal-g/wal-g/pull/1062 - Patch, Third Party Advisory |
12 Aug 2021, 16:53
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-08-12 16:15
Updated : 2024-11-21 06:17
NVD link : CVE-2021-38599
Mitre link : CVE-2021-38599
CVE.ORG link : CVE-2021-38599
JSON object : View
Products Affected
wal-g_project
- wal-g
CWE
CWE-754
Improper Check for Unusual or Exceptional Conditions