Vulnerability Report: GO-2023-2137

Affected Packages

• Path
  Versions
  Symbols
• github.com/ydb-platform/ydb-go-sdk/v3
  from v3.48.6 before v3.53.3
  22 affected symbols

  • Connector
  • Driver.Close
  • Driver.Coordination
  • Driver.Discovery
  • Driver.Ratelimiter
  • Driver.Scheme
  • Driver.Scripting
  • Driver.Table
  • Driver.Topic
  • Driver.With
  • IsTimeoutError
  • IsTransportError
  • MustConnector
  • MustOpen
  • New
  • Open
  • Unwrap
  • WithAccessTokenCredentials
  • WithAnonymousCredentials
  • WithCertificatesFromFile
  • WithRequestType
  • WithTraceID
• github.com/ydb-platform/ydb-go-sdk/v3/credentials
  from v3.48.6 before v3.53.3
  • NewAccessTokenCredentials
  • NewAnonymousCredentials
  • NewStaticCredentials
  • WithSourceInfo
• github.com/ydb-platform/ydb-go-sdk/v3/internal/balancer
  from v3.48.6 before v3.53.3
  • Balancer.Invoke
  • Balancer.NewStream
  • New
• github.com/ydb-platform/ydb-go-sdk/v3/internal/conn
  from v3.48.6 before v3.53.3
  • WithAfterFunc
• github.com/ydb-platform/ydb-go-sdk/v3/internal/credentials
  from v3.48.6 before v3.53.3
  7 affected symbols

  • AccessToken.String
  • Anonymous.String
  • NewAccessTokenCredentials
  • NewAnonymousCredentials
  • NewStaticCredentials
  • Static.String
  • WithSourceInfo

Aliases

• CVE-2023-45825
• GHSA-q24m-6h38-5xj8

References

• https://github.com/ydb-platform/ydb-go-sdk/security/advisories/GHSA-q24m-6h38-5xj8
• https://github.com/ydb-platform/ydb-go-sdk/pull/859
• https://github.com/ydb-platform/ydb-go-sdk/commit/a0d92057c4e1bbdc5e85ae8d649edb0232b8fd4c
• https://vuln.go.dev/ID/GO-2023-2137.json

Feedback