Homepage

ddtrace@4.14.2

Datadog APM client library

  • latest version

    4.16.1

  • latest non vulnerable version

    4.16.1

  • first published

    9 years ago

  • latest version published

    2 days ago

  • licenses detected

  • View ddtrace package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the ddtrace package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Regular Expression Denial of Service (ReDoS)

    ddtrace is a Datadog APM client library

    Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the redact_query_string function in ddtrace/internal/utils/http.py, which applies a query string obfuscation regex without guarding against quadratic (catastrophic) backtracking. An attacker who can cause an instrumented HTTP integration to process a URL containing a query string can trigger worst-case regex evaluation time, crashing or stalling the traced process and causing a denial of service.

    How to fix Regular Expression Denial of Service (ReDoS)?

    Upgrade ddtrace to version 3.19.9, 4.15.6 or higher.

    [1.5.0,3.19.9)[4.0.0,4.15.6)
    • H
    Uncaught Exception

    ddtrace is a Datadog APM client library

    Affected versions of this package are vulnerable to Uncaught Exception via modulo_aspect in the IAST taint-tracking C++ extension, when a lone surrogate character is passed as a format argument to the % (modulo) string operator. The unhandled surrogate causes a process abort, crashing the entire Python process.

    Note: This is only exploitable if the IAST feature is explicitly enabled, as it is disabled by default.

    How to fix Uncaught Exception?

    Upgrade ddtrace to version 4.15.5 or higher.

    [3.13.0,4.15.5)
    Go back to all versions of this package