1460 matches found
portfolio-website (>=1.1.2, <=1.1.6) potentially affected by CVE-2024-40647 via sentry-sdk (0.10.0)
sentry-sdk PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - portfolio-website =1.1.2, =1.1.6 Source cves: CVE-2024-40647 Source advisory: OSV:GHSA-G92J-QHMH-64V2...
scrapy-sentry-sdk (0.4.0) potentially affected by CVE-2024-40647 via sentry-sdk (0.9.5)
sentry-sdk PYPI version 0.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - scrapy-sentry-sdk 0.4.0 Source cves: CVE-2024-40647 Source advisory: OSV:GHSA-G92J-QHMH-64V2...
GHSA-G92J-QHMH-64V2 Sentry's Python SDK unintentionally exposes environment variables to subprocesses
Impact The bug in Sentry's Python SDK subprocess.checkoutput"env", env="TEST":"1" b'TEST=1\n' If you'd want to not pass any variables, you can set an empty dict: subprocess.checkoutput"env", env= b'' However, the bug in Sentry SDK 2.8.0 causes all environment variables to be passed to the...
CVE-2024-40647
sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK 2.8.0 allows the environment variables to be passed to subprocesses despite the env= setting. In Python's subprocess calls, all environment variables are passed to subprocesses by default. However, if you specifical...
DEBIAN-CVE-2024-40647
sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK 2.8.0 allows the environment variables to be passed to subprocesses despite the env= setting. In Python's subprocess calls, all environment variables are passed to subprocesses by default. However, if you specifical...
UBUNTU-CVE-2024-40647
sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK 2.8.0 allows the environment variables to be passed to subprocesses despite the env= setting. In Python's subprocess calls, all environment variables are passed to subprocesses by default. However, if you specifical...
CVE-2024-40647
sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK 2.8.0 allows the environment variables to be passed to subprocesses despite the env= setting. In Python's subprocess calls, all environment variables are passed to subprocesses by default. However, if you specifical...
CVE-2024-40647
sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK 2.8.0 allows the environment variables to be passed to subprocesses despite the env= setting. In Python's subprocess calls, all environment variables are passed to subprocesses by default. However, if you specifical...
CVE-2024-40647
sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK 2.8.0 allows the environment variables to be passed to subprocesses despite the "env=" setting. In Python's "subprocess" calls, all environment variables are passed to subprocesses by default. However, if you...
1a23-telemetry (1.0.0), agave (>=0.0.1.dev0, <=0.0.2.dev0) +333 more potentially affected by CVE-2024-40647 via sentry-sdk (>=0.3.0, <=1.45.0)
sentry-sdk PYPI version =0.3.0, =0.0.1.dev0, =0.1.1, =0.1.45, =0.0.2, =0.0.1, =3.1.4, =0.6.2, =0.2.8, =0.1.0, =2.5.7, =2.85.0 - apirunner 1.1.0 - apis-ampel 0.1.0 and more Source cves: CVE-2024-40647 Source advisory: MEND:CVE-2024-40647...
big-graph-dataset (>=0.0.1, <=0.0.8.post4), bugsink (0.1.12) +28 more potentially affected by CVE-2024-40647 via sentry-sdk (>=2.0.0rc4, <=2.7.1)
sentry-sdk PYPI version =2.0.0rc4, =0.0.1, =1.7.0, =2.2.47, =2.2.47, =0.50.0, =1.8.0, =0.20.0, =2024.7.0b2, =0.5.27, =0.1.10, =2.2.2, =2.2.0.post1, =2024.6.0, =2024.6.1 and more Source cves: CVE-2024-40647 Source advisory: MEND:CVE-2024-40647...
CVE-2024-40647 Unintentional exposure of environment variables to subprocesses in sentry-sdk
sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK 2.8.0 allows the environment variables to be passed to subprocesses despite the env= setting. In Python's subprocess calls, all environment variables are passed to subprocesses by default. However, if you specifical...
CVE-2024-40647
CVE-2024-40647 affects the Python SDK for Sentry (sentry-sdk) prior to 2.8.0. With the Stdlib integration enabled by default, a bug causes environment variables to be passed to subprocesses in Python’s subprocess calls, even when env={} is specified. The issue is fixed in sentry-sdk 2.8.0 (and pa...
CVE-2024-40647: Exposure of Sensitive Information to an Unauthorized Actor
sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK 2.8.0 allows the environment variables to be passed to subprocesses despite the env= setting. In Python's subprocess calls, all environment variables are passed to subprocesses by default. However, if you specifical...
PT-2024-28964
Name of the Vulnerable Software and Affected Versions sentry-sdk versions prior to 2.8.0 Description A bug in the sentry-sdk allows environment variables to be passed to subprocesses despite the env= setting. In Python's subprocess calls, all environment variables are passed to subprocesses by...
WordPress Sentry plugin <= 7.8.0 - Malicious Polyfill.io Embed vulnerability
Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin Sentry versions = 7.8.0...
WordPress Sentry Plugin <= 7.8.0 is vulnerable to Backdoor
Software Sentry Type Plugin Vulnerable versions = 7.8.0 Fixed in 7.9.0 OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 7ce3176e4766 Credits Sansec.io Required privilege Unauthenticated Published 3 July, 2024...
Ivanti Sentry Authentication Bypass
Ivanti Sentry, formerly known as MobileIron Sentry, is vulnerable to an API authentication bypass on the Sentry administrator interface. A remote and unauthenticated attacker can leverage this vulnerability to gain access to sensitive APIs and achieve OS command execution as the root user on the...
drf-httpsig (>=1.0.0, <=1.0.2), sentry (>=7.7.1, <=7.7.4) potentially affected by CVE-2024-21520 via djangorestframework (2.3.14)
djangorestframework PYPI version 2.3.14 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework and may be impacted: - drf-httpsig =1.0.0, =7.7.1, =7.7.4 Source cves: CVE-2024-21520 Source advisory: OSV:GHSA-GW84-84PC-XP82...