N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-28xx-pppm-vqff

GHSA-28xx-pppm-vqff: ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction

Impact

Transactions were NOT committed despite the explicit options.WithCommit flag using table service client. Because of this, clients did not commit changes to the transaction, relying on the fact that the transaction commit was successful. This led (in rare cases) to a loss of data consistency.

Patches

ydb-go-sdk contains this problem in versions from v3.104.6 to v3.134.1. The fix for this problem has been released in version v3.134.2 (https://github.com/ydb-platform/ydb-go-sdk/pull/2091).

Workarounds

Use explicit table.Transaction.CommitTx(ctx) instead use options.WithCommit().
Use transaction retrier db.Table().DoTx(ctx, lambda) instead explicit start transaction on session.
Use query client db.Query().Do(ctx, lambda) with the same logic in lambda

Resources

Commit with bug https://github.com/ydb-platform/ydb-go-sdk/commit/251128a64763555d9a79ee7a131dd154c9000eb9 Commit with fix https://github.com/ydb-platform/ydb-go-sdk/commit/25dcff4c41153f1f9413512ba12999b40bf7154d

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-28xx-pppm-vqff

GHSA-28xx-pppm-vqff:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/ydb-platform/ydb-go-sdk/v3	go	>= 3.104.6, <= 3.134.1	3.134.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the handling of transaction control options, specifically the options.WithCommit() flag. When a user calls transaction.Execute with this option, the intention is to commit the transaction after the query execution. The bug was introduced in a refactoring (commit 251128a64763555d9a79ee7a131dd154c9000eb9) that led to the transaction control settings being overwritten down the call stack.

The call flow is as follows: transaction.Execute() -> Session.Execute() -> tableClientExecutor.execute().

Session.Execute() would correctly prepare the gRPC request with the commit flag set. However, tableClientExecutor.execute() would then incorrectly overwrite the TxControl field of the request, effectively discarding the commit flag. This meant the final request sent to the YDB server did not include the instruction to commit the transaction.

The fix (commit 25dcff4c41153f1f9413512ba12999b40bf7154d) resolves this by removing the overwriting logic from tableClientExecutor.execute(), ensuring that the transaction control settings prepared by Session.Execute() are preserved. The primary vulnerable function is tableClientExecutor.execute where the faulty logic resided, but transaction.Execute is also listed as it is the public-facing function that developers would observe the incorrect behavior from.

Vulnerable functions

tableClientExecutor.execute

internal/table/session.go

This function was incorrectly overwriting the transaction control settings that were already prepared by `Session.Execute`. This overwriting caused the `options.WithCommit()` flag to be lost, leading to transactions not being committed when requested. The fix involved removing the redundant and incorrect setting of the transaction control within this function.

transaction.Execute

internal/table/transaction.go

This is the primary user-facing function that a developer would call to execute a query within a transaction and commit it using `options.WithCommit()`. Due to the bug in the underlying implementation (`tableClientExecutor.execute`), the commit action was not being performed, making this function's behavior unreliable and leading to potential data loss or inconsistency.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.