Read the docs
TI-2023-24585 Aliases CVE-2023-45825GHSA-q24m-6h38-5xj8

Token in custom credentials object can leak through logs in ydb-go-sdk

Priority LOW 24CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object (implementation of interface Credentials it may leak into logs. This happens because this object could be serialized into an error message using `fmt.Errorf("something went wrong (credentials: %q)", credentials)` during connection to the YDB server. If such logging occurred, a malicious user with access to logs could read sensitive information (i.e. credentials) information and use it to get access to the database. ydb-go-sdk contains this problem in versions from v3.48.6 to v3.53.2. The fix for this problem has been released in version v3.53.3. Users are advised to upgrade. Users unable to upgrade should implement the `fmt.Stringer` interface in your custom credentials type with explicit stringify of object state.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00234 14th percentileScored 2026-11-07
Fix Fixed ydb-go-sdk (ydb-platform): 3.53.3github.com/ydb-platform/ydb-go-sdk/v3 (Go): 3.53.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ydb-platformydb-go-sdk3.48.6 to before 3.53.33.53.3Patch availableCNA
—github.com/ydb-platform/ydb-go-sdk/v3 (Go)3.48.6 to before 3.53.33.53.3Patch availableGHSA-q24m-6h38-5xj8
  • ydb-go-sdk Vendorydb-platform Affected 3.48.6 to before 3.53.3 Fixed in 3.53.3 Patch available CNA
  • github.com/ydb-platform/ydb-go-sdk/v3 (Go) Vendor— Affected 3.48.6 to before 3.53.3 Fixed in 3.53.3 Patch available GHSA-q24m-6h38-5xj8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ydb:ydb-go-sdk:*:*:*:*:*:go:*:*3.48.6 to before 3.53.2VulnerableYdb
  • cpe:2.3:a:ydb:ydb-go-sdk:*:*:*:*:*:go:*:* Versions 3.48.6 to before 3.53.2 Vulnerable ·Ydb

Remediation

  • Fix · CNA ydb-go-sdk (ydb-platform) Fixed in 3.53.3
  • Fix · GHSA-q24m-6h38-5xj8 github.com/ydb-platform/ydb-go-sdk/v3 (Go) Fixed in 3.53.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-45825
  2. 2026-10-03 Alias added: GHSA-q24m-6h38-5xj8

References

Advisory 2

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences