Moderate severity vulnerability that affects airbrake

2019-02-18T23:58:13
ID GHSA-856X-CP3Q-47VG
Type github
Reporter GitHub Advisory Database
Modified 2019-07-03T21:02:06

Description

The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all the secret keys the user is sending. This goes against common best practice, which is to use HTTPS.