Vulnerabilities > CVE-2021-38599 - Improper Check for Unusual or Exceptional Conditions vulnerability in Wal-G Project Wal-G

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

wal-g-project

CWE-754

NVD

Published: 2021-08-12

Updated: 2022-07-12

Summary

WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity."

Vulnerable Configurations

Part	Description	Count
Application	Wal-G_Project WAL G Project WAL G - WAL G Project WAL G 0.1.0 WAL G Project WAL G 0.1.1 WAL G Project WAL G 0.1.2 WAL G Project WAL G 0.1.3 WAL G Project WAL G 0.1.4 WAL G Project WAL G 0.1.5 WAL G Project WAL G 0.1.6 WAL G Project WAL G 0.1.7 WAL G Project WAL G 0.1.8 WAL G Project WAL G 0.1.9 WAL G Project WAL G 0.1.10 WAL G Project WAL G 0.1.11 WAL G Project WAL G 0.1.12 WAL G Project WAL G 0.1.13 WAL G Project WAL G 0.1.14 WAL G Project WAL G 0.1.15 WAL G Project WAL G 0.1.16 WAL G Project WAL G 0.1.17 WAL G Project WAL G 0.2.0 WAL G Project WAL G 0.2.1 WAL G Project WAL G 0.2.2 WAL G Project WAL G 0.2.3 WAL G Project WAL G 0.2.4 WAL G Project WAL G 0.2.5 WAL G Project WAL G 0.2.6 WAL G Project WAL G 0.2.7 WAL G Project WAL G 0.2.8 WAL G Project WAL G 0.2.9 WAL G Project WAL G 0.2.10 WAL G Project WAL G 0.2.10A WAL G Project WAL G 0.2.11 WAL G Project WAL G 0.2.12 WAL G Project WAL G 0.2.13 WAL G Project WAL G 0.2.14 WAL G Project WAL G 0.2.14A WAL G Project WAL G 0.2.15 WAL G Project WAL G 0.2.16 WAL G Project WAL G 0.2.17 WAL G Project WAL G 0.2.18 WAL G Project WAL G 0.2.19 WAL G Project WAL G 0.2.20 WAL G Project WAL G 0.2.21 WAL G Project WAL G 0.2.22 WAL G Project WAL G 1.0	45

Common Weakness Enumeration (CWE)

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References