Medium, CVSS 6.9PyPIAmendedPublished
ops leaking secrets if subprocess.CalledProcessError happens with a secret-* CLI command
CVE-2024-41129 · GHSA-hcmv-jmqh-fjgm
- Affected
- PyPI ops >= 2.0.0, < 2.15.0
- Fixed in
- 2.15.0· Vendor fix available
- Issue
- The issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (=3.0), Juju secrets and not correctly capturing and processing subprocess.CalledProcessError. There are two points that may log this command, in different files: First, if there is an error during a secret handling, there will be a subprocess.CalledProcessError, which will contain the CLI comand + all its args. This is going to be logged in any logging level. This exception, if not caught by the charm, will bubble up to the /var/log/juju/ logs and syslog journal. Now, on Ubuntu 22.04, these logs are protected with: Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening. Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g.…
Recommended action: Upgrade to 2.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.