Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The bug in Sentry's Python SDK <2.8.0 results in the unintentional exposure of environment variables to subprocesses despite the env={} setting. Details In Python's subprocess calls, all environment variables are passed to subprocesses by default. However, if you specifically do not want them to be passed to subprocesses, you may use env argument in subprocess calls, like in this example: If you'd want to not pass any variables, you can set an empty dict: However, the bug in Sentry SDK <2.8.0 causes all environment variables to be passed to the subprocesses when env={} is set, unless the Sentry SDK's Stdlib integration is disabled. The Stdlib integration is enabled by default. Patches The issue has been patched in https://github.com/getsentry/sentry-python/pull/3251 and the fix released in sentry-sdk==2.8.0. The fix was also backported to sentry-sdk==1.45.1. Workarounds We strongly recommend upgrading to the latest SDK version. However, if it's not possible, and if passing…
Recommended action: Upgrade to 2.8.0 or 1.45.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When using the Django integration of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies values, including the session cookie to Sentry. These sensitive cookies could then be used by someone with access to your Sentry issues to impersonate or escalate their privileges within your application. The below must be true in order for these sensitive values to be leaked: 1. Your Sentry SDK configuration has sendDefaultPII set to True 2. You are using a custom name for either of the cookies below in your Django settings. - SESSIONCOOKIENAME or - CSRFCOOKIENAME Django settings 3. You are not configured in your organization or project settings to use our data scrubbing features to account for the custom cookie names Patches As of version 1.14.0, the Django integration of the sentry-sdk will detect the custom cookie names based on your Django settings and will remove the values from the payload before sending the data to Sentry. Workarounds If you can not…
Recommended action: Upgrade to 1.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.