CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium…

published August 12, 2021

CVSS
—
EPSS
1%
Percentile
57.2
In the wild
Unconfirmed
What it is

WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity."

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00834 · 57.2th percentile
Published
2021-08-12T15:01Z
EPSS history
Timeline
  • 12 AUG 15:01Z
    WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium…
    cvelistv5