PT-2021-22237 · Wal-G · Wal-G

Sehrope · Published 2021-08-12 · Updated 2022-07-12 · CVE-2021-38599

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WAL-G versions prior to 1.1

Description The issue arises when a non-libsodium build of WAL-G is used, causing it to silently ignore the libsodium encryption key and upload backups in cleartext. This behavior is considered a violation of the Principle of Least Surprise, as users likely intend to encrypt all file activity.

Recommendations For versions prior to 1.1, update to version 1.1 or later to ensure that backups are properly encrypted. As a temporary workaround, consider avoiding the use of non-libsodium builds until a secure version is available.

Fix

Improper Check for Exceptional Conditions

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-754

CWE-922

Related Identifiers

CVE-2021-38599

GHSA-VRMR-F2QH-3HHF

Affected Products

Wal-G

References · 8

• https://github.com/wal-g/wal-g/commit/cadf598e1c2a345915a21a44518c5a4d5401e2e3 · Patch
• https://github.com/wal-g/wal-g/pull/1062 · Patch
• https://osv.dev/vulnerability/GHSA-vrmr-f2qh-3hhf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38599 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38599 · Security Note
• https://github.com/wal-g/wal-g · Note
• https://github.com/wal-g/wal-g/releases/tag/v1.1 · Note
• https://t.me/cibsecurity/27246 · Telegram Post