Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ChannelCredentialsBuilder leaks secrets on drop #4311

Closed
brson opened this issue Mar 5, 2019 · 1 comment
Closed

ChannelCredentialsBuilder leaks secrets on drop #4311

brson opened this issue Mar 5, 2019 · 1 comment
Labels
type/bug Type: Issue - Confirmed a bug

Comments

@brson
Copy link
Contributor

brson commented Mar 5, 2019

ChannelCredentialsBuilder contains an Option field called cert_key_pair that contains secrets when Some. The drop function assumes that cert_key_pair has been moved into grpc_sys, but it is possible for that not to be true if build is never called.

The drop method should look into this field and call clear_key_securely on it if it still exists.
@brson brson added the type/bug Type: Issue - Confirmed a bug label Mar 5, 2019
@brson
Copy link
Contributor Author

brson commented Mar 5, 2019

This is incorrect. Not sure what I was looking at.

@brson brson closed this as completed Mar 5, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
type/bug Type: Issue - Confirmed a bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@brson