Low, CVSS 0.5PyPIAmendedPublished
cdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration code
CVE-2024-22194 · GHSA-rgrf-6mf5-m882
- Affected
- PyPI case-utils >= 0.5.0, <= 0.5.0; >= 0.6.0, <= 0.6.0; >= 0.7.0, <= 0.7.0; >= 0.8.0, <= 0.8.0; >= 0.9.0, <= 0.9.0; >= 0.10.0, <= 0.10.0; >= 0.11.0, <= 0.11.0; >= 0.12.0, <= 0.12.0; >= 0.13.0, <= 0.13.0; >= 0.14.0, <= 0.14.0
- Fixed in
- 0.11.10.13.10.8.10.12.10.9.10.5.10.6.10.10.10.14.10.7.1· Vendor fix available
- Issue
- Impact What kind of vulnerability is it? Who is impacted? An information leakage vulnerability is present in cdo-local-uuid at version 0.4.0, and in case-utils in unpatched versions (matching the pattern 0.x.0) at and since 0.5.0, before 0.15.0. The vulnerability stems from a Python function, cdolocaluuid.localuuid(), and its original implementation caseutils.localuuid(). Henceforth, both will be called localuuid(). localuuid() generates UUIDv5s using a deterministic pseudorandom number stream. This was written to make graph application demonstrations generate consistent, version-controllable output with minimal noise caused by demonstration re-runs. Part of the information used to keep individual examples' generated output distinct from one another is seed information from the caller's environment, particularly the program's argument vector. The present working directory is also included as part of the seed information, but for reasons including maintaining user environment privacy,…
Recommended action: Upgrade to 0.14.1, 0.13.1, 0.12.1 or 7 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.