Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

datadog/dd-trace

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedPackagistPublished

    datadog/dd-trace Circumvents open_basedir INI directive

    GHSA-qvgg-r6rq-vwfx

    Affected
    • Packagist datadog/dd-trace >= 0.30.0, < 0.30.2
    Fixed in
    0.30.2· Vendor fix available
    Issue
    datadog/dd-trace versions 0.30.0 prior to 0.30.2 are affected by a security and stability issue outlined in PR #579. This pull request ensures that the ddtrace.requestinithook remains bound by the openbasedir INI directive, effectively addressing potential vulnerabilities related to openbasedir restrictions. The update introduces a sandboxing mechanism to isolate the request init hook from errors or exceptions during execution, enhancing the library's stability and preventing adverse impacts on the main script.

    Recommended action: Upgrade to 0.30.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →