Snyk Security Database

0xhash-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

boltz is a Boltz

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the mol.py file. An attacker with the ability to place a malicious pickle file in a directory can execute arbitrary code without validation.

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the obfuscate_literals option in query logging. An attacker can access sensitive information by reading unredacted error data in the query logs when queries fail.

Notes:

This is only exploitable if the attacker has legitimate access to the local log files and can execute queries that trigger errors.

If your configuration had db.logs.query.obfuscate_literals enabled, and you wish the obfuscation to cover the error messages as well, you need to enable the new configuration setting db.logs.query.obfuscate_errors once you have upgraded Neo4j.