CVE-2021-38599 (published 2021-08-12T16:15Z)

WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity."

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-754
cwe_name: Improper Check for Unusual or Exceptional Conditions
description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
extended_description: 
            The programmer may assume that certain events or conditions will never occur or do not need to be worried about, such as low memory conditions, lack of access to resources due to restrictive permissions, or misbehaving clients or components. However, attackers may intentionally trigger these unusual conditions, thus violating the programmer's assumptions, possibly introducing instability, incorrect behavior, or a vulnerability.
            Note that this entry is not exclusively about the use of exceptions and exception handling, which are mechanisms for both checking and handling unusual or unexpected conditions.
         
         

Fix information:
repo_url: https://github.com/wal-g/wal-g
commit_details: repo_url: https://github.com/wal-g/wal-g
author: Sehrope Sarkuni
author_date: 2021-08-12 02:29:13-04:00
msg: Fix libsodium missing from GitHub Releases (#1062)

* Fix release GitHub action to enable libsodium

* Exit with failure if keys are detected but not compiled with libsodium support

Adds a check for the existence of libsodium keys in non-libsodium builds. If keys are detected then
exit with failure as the user likely wanted to encrypt all file activity but it is not possible as
the application was not compiled with support for libsodium.

Previously, wal-g would continue to operate as if no encryption was requested.

* Add option to manually trigger GitHub Action CI
repository: repo_url: https://github.com/wal-g/wal-g
repo_name: wal-g/wal-g
description: Archival and Restoration for databases in the Cloud
repo_language: Go
owner: wal-g
file_changes: filename: release.yml
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,7 @@ on:
 
 env:
   GO_VERSION: 1.15
+  USE_LIBSODIUM: 1
 
 jobs:
   release-ubuntu:

programming_language: Markdown
filename: unittests.yml
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 name: Unit tests
 
 on:
+  workflow_dispatch:
   push:
     branches: [ master ]
   pull_request:

programming_language: Markdown
filename: configure_crypter.go
change_type: ModificationType.MODIFY
diff: @@ -14,9 +14,19 @@ package internal
 // If there is a tag, we can configure the correct implementation of crypter.
 
 import (
+	"github.com/spf13/viper"
+	"github.com/wal-g/tracelog"
 	"github.com/wal-g/wal-g/internal/crypto"
 )
 
 func configureLibsodiumCrypter() crypto.Crypter {
+	if viper.IsSet(LibsodiumKeySetting) {
+		tracelog.ErrorLogger.Fatalf("non-empty WALG_LIBSODIUM_KEY but wal-g was not compiled with libsodium")
+	}
+
+	if viper.IsSet(LibsodiumKeyPathSetting) {
+		tracelog.ErrorLogger.Fatalf("non-empty WALG_LIBSODIUM_KEY_PATH but wal-g was not compiled with libsodium")
+	}
+
 	return nil
 }

programming_language: Go