Lucene search

K
osvGoogleOSV:GHSA-VRMR-F2QH-3HHF
HistorySep 02, 2021 - 5:17 p.m.

Improper use of cryptographic key in wal-g

2021-09-0217:17:16
Google
osv.dev
7

0.001 Low

EPSS

Percentile

41.9%

WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because “the user likely wanted to encrypt all file activity.”

CPENameOperatorVersion
github.com/wal-g/wal-glt1.1

0.001 Low

EPSS

Percentile

41.9%

Related for OSV:GHSA-VRMR-F2QH-3HHF