Skip to content

fix(deps): Update module github.com/go-viper/mapstructure/v2 to v2.3.0 [SECURITY]#20919

Merged
kodiakhq[bot] merged 1 commit intomainfrom
renovate/go-github.com-go-viper-mapstructure-v2-vulnerability
Jun 27, 2025
Merged

fix(deps): Update module github.com/go-viper/mapstructure/v2 to v2.3.0 [SECURITY]#20919
kodiakhq[bot] merged 1 commit intomainfrom
renovate/go-github.com-go-viper-mapstructure-v2-vulnerability

Conversation

@cq-bot
Copy link
Copy Markdown
Contributor

@cq-bot cq-bot commented Jun 27, 2025

This PR contains the following updates:

Package Type Update Change
github.com/go-viper/mapstructure/v2 indirect minor v2.2.1 -> v2.3.0

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

GHSA-fv92-fjc5-jj9h

Summary

Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields.

Details

OpenBao (and presumably HashiCorp Vault) have surfaced error messages from mapstructure as follows:

https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L43-L50

			_, _, err := d.getPrimitive(field, schema)
			if err != nil {
				return fmt.Errorf("error converting input for field %q: %w", field, err)
			}

where this calls mapstructure.WeakDecode(...): https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193

func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
	raw, ok := d.Raw[k]
	if !ok {
		return nil, false, nil
	}

	switch t := schema.Type; t {
	case TypeBool:
		var result bool
		if err := mapstructure.WeakDecode(raw, &result); err != nil {
			return nil, false, err
		}
		return result, true, nil

Notably, WeakDecode(...) eventually calls one of the decode helpers, which surfaces the original value:

https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L679-L686

https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L726-L730

https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L783-L787

& more.

PoC

To reproduce with OpenBao:

$ podman run -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300

and in a new tab:

$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"password":{"asdf":"my-sensitive-value"}}' "http://localhost:8300/v1/auth/userpass/users/adsf"
{"errors":["error converting input for field \"password\": '' expected type 'string', got unconvertible type 'map[string]interface {}', value: 'map[asdf:my-sensitive-value]'"]}

Impact

This is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at '' expected a map, got 'string' -- when the field type is string and a map is provided, we see the above information leak -- the previous example had a map type field with a string value provided).

This was rated 4.5 Medium by HashiCorp in the past iteration.

Release Notes

go-viper/mapstructure (github.com/go-viper/mapstructure/v2)

v2.3.0

Compare Source

What's Changed
New Contributors

Full Changelog: go-viper/mapstructure@v2.2.1...v2.3.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@cq-bot cq-bot added automerge Automatically merge once required checks pass security labels Jun 27, 2025
@cq-bot
Copy link
Copy Markdown
Contributor Author

cq-bot commented Jun 27, 2025

/gen sha=d6c5f4183c1f1f55d074394d9e3d26cf2d5b7b25 dir=plugins/destination/duckdb

@cq-bot
Copy link
Copy Markdown
Contributor Author

cq-bot commented Jun 27, 2025

/gen sha=d6c5f4183c1f1f55d074394d9e3d26cf2d5b7b25 dir=cli

@kodiakhq kodiakhq bot merged commit 889d994 into main Jun 27, 2025
20 checks passed
@kodiakhq kodiakhq bot deleted the renovate/go-github.com-go-viper-mapstructure-v2-vulnerability branch June 27, 2025 18:30
This was referenced Jun 27, 2025
Merged
Merged
kodiakhq bot pushed a commit that referenced this pull request Jul 2, 2025
@cq-bot
chore(main): Release plugins-destination-duckdb v6.0.9 (#20922)
420eece 
🤖 I have created a release *beep* *boop*
---


## [6.0.9](plugins-destination-duckdb-v6.0.8...plugins-destination-duckdb-v6.0.9) (2025-07-02)


### Bug Fixes

* **deps:** Update module github.com/go-viper/mapstructure/v2 to v2.3.0 [SECURITY] ([#20919](#20919)) ([889d994](889d994))

---
This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).
kodiakhq bot pushed a commit that referenced this pull request Jul 2, 2025
@cq-bot
chore(main): Release cli v6.21.1 (#20913)
30d3513 
🤖 I have created a release *beep* *boop*
---


## [6.21.1](cli-v6.21.0...cli-v6.21.1) (2025-07-02)


### Bug Fixes

* **deps:** Update golang.org/x/exp digest to b7579e2 ([#20935](#20935)) ([aac340d](aac340d))
* **deps:** Update module github.com/cloudquery/cloudquery-api-go to v1.13.10 ([#20920](#20920)) ([93fed18](93fed18))
* **deps:** Update module github.com/cloudquery/cloudquery-api-go to v1.13.11 ([#20941](#20941)) ([a67fcc5](a67fcc5))
* **deps:** Update module github.com/cloudquery/codegen to v0.3.29 ([#20947](#20947)) ([af179be](af179be))
* **deps:** Update module github.com/cloudquery/plugin-pb-go to v1.26.13 ([#20912](#20912)) ([f9ff32f](f9ff32f))
* **deps:** Update module github.com/cloudquery/plugin-pb-go to v1.26.14 ([#20929](#20929)) ([41fbbd0](41fbbd0))
* **deps:** Update module github.com/cloudquery/plugin-pb-go to v1.26.15 ([#20943](#20943)) ([c8abdae](c8abdae))
* **deps:** Update module github.com/go-viper/mapstructure/v2 to v2.3.0 [SECURITY] ([#20919](#20919)) ([889d994](889d994))

---
This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kodiakhq kodiakhq[bot] kodiakhq[bot] approved these changes

Assignees

No one assigned

Labels

area/cli area/plugin/destination/duckdb automerge Automatically merge once required checks pass security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@cq-bot