GHSA-92wq-q9pq-gw47

Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-92wq-q9pq-gw47/GHSA-92wq-q9pq-gw47.json

Aliases

• CVE-2023-31135

Published

2023-05-17T17:07:40Z

Modified

2023-05-25T19:07:49Z

Details

Impact

Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.

Patches

This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.

Workarounds

Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.

References

See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.

References

• https://github.com/dgraph-io/dgraph/security/advisories/GHSA-92wq-q9pq-gw47
• https://nvd.nist.gov/vuln/detail/CVE-2023-31135
• https://github.com/dgraph-io/dgraph/pull/8323
• https://en.wikipedia.org/wiki/Cryptographic_nonce
• https://github.com/dgraph-io/dgraph
• https://github.com/dgraph-io/dgraph/releases/tag/v23.0.0