Insertion of Sensitive Information into Log File Affecting github.com/edgelesssys/contrast/internal/meshapi package, versions <1.8.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Insertion of Sensitive Information into Log File vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-GOLANG-GITHUBCOMEDGELESSSYSCONTRASTINTERNALMESHAPI-10359233
- published15 Jun 2025
- disclosed28 May 2025
- creditMarkus Rudy
Introduced: 28 May 2025
CVE NOT AVAILABLE CWE-532 Â (opens in a new tab)How to fix?
Upgrade github.com/edgelesssys/contrast/internal/meshapi to version 1.8.1 or higher.
Overview
Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File due to the logging configuration. An attacker can access sensitive information by exploiting the log output when the log level is set to info or debug. This is only exploitable if the CONTRAST_LOG_LEVEL is not set to warn or higher.
Workaround
This vulnerability can be mitigated by adding an environment variable CONTRAST_LOG_LEVEL=warn to the initializer after running contrast generate, and then running contrast generate again.