Skip to content
OpenAdvisories
Medium · 5.3 CVE-2024-32967 EUVD-2024-1736GHSA-q5qj-x2h5-3945GO-2024-2804

Zitadel exposes internal database user name and host information

Published May 1, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Vendor: zitadel Product: zitadel Package: github.com/zitadel/zitadel Ecosystem: Go

Description

Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no workaround since a patch is already available. Users are advised to upgrade.

Affected products

VendorProductAffectedFixed
zitadel zitadel < 2.45.7, >= 2.46.0,< 2.46.7, >= 2.47.0, < 2.47.10, >= 2.48.0, < 2.48.5, >= 2.49.0, < 2.49.5, >= 2.50.0, < 2.50.3 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/zitadel/zitadel >= 2.50.0, < 2.50.3 2.50.3 GHSA-q5qj-x2h5-3945
Go github.com/zitadel/zitadel >= 2.49.0, < 2.49.5 2.49.5 GHSA-q5qj-x2h5-3945
Go github.com/zitadel/zitadel >= 2.48.0, < 2.48.5 2.48.5 GHSA-q5qj-x2h5-3945
Go github.com/zitadel/zitadel >= 2.47.0, < 2.47.10 2.47.10 GHSA-q5qj-x2h5-3945
Go github.com/zitadel/zitadel < 2.45.7 2.45.7 GHSA-q5qj-x2h5-3945
Go github.com/zitadel/zitadel all versions — GO-2024-2804

References