id: GO-2024-2978
modules:
    - module: google.golang.org/grpc
      versions:
        - introduced: 1.64.0
        - fixed: 1.64.1
      vulnerable_at: 1.64.0
      packages:
        - package: google.golang.org/grpc/metadata
          symbols:
            - MD.String
summary: |-
    Private tokens could appear in logs if context containing gRPC metadata is
    logged in google.golang.org/grpc
description: |
    If applications print or log a context containing gRPC metadata, the
    output will contain all the metadata, which may include private
    information. This represents a potential PII concern.
ghsas:
    - GHSA-xr7q-jx4m-x55m
references:
    - advisory: https://github.com/grpc/grpc-go/security/advisories/GHSA-xr7q-jx4m-x55m
    - fix: https://github.com/grpc/grpc-go/commit/ab292411ddc0f3b7a7786754d1fe05264c3021eb
source:
    id: GHSA-xr7q-jx4m-x55m
    created: 2024-07-08T13:23:23.725948-04:00
review_status: REVIEWED