CVE-2023-46255: 
NixOS vulnerability analysis and mitigation

SpiceDB, an open source Google Zanzibar-inspired database for creating and managing security-critical application permissions, was found to have a sensitive information disclosure vulnerability. Prior to version 1.27.0-rc1, when a malformed datastore URI was provided (e.g., containing a password with ':'), the full URI including the password would be exposed in the logs (GitHub Advisory, NVD).

The vulnerability is tracked as CVE-2023-46255 and has been assigned a CVSS v3.1 base score of 6.5 MEDIUM by NIST NVD, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The issue specifically occurs during the parsing of datastore configuration, where malformed URIs trigger error messages that include the complete connection string, thereby exposing sensitive credentials in log files (NVD).

The vulnerability could lead to the exposure of database credentials in log files, potentially compromising the security of the database if logs are accessible to unauthorized users. The issue primarily affects confidentiality, with no direct impact on integrity or availability (GitHub Advisory).

The vulnerability has been patched in SpiceDB version 1.27.0-rc1. Users are advised to upgrade to this version or later to address the issue. The fix includes proper redaction of sensitive information in error messages (GitHub Advisory).