Use of Cache Containing Sensitive Information Affecting geolens package, versions [,1.2.4)

geolens is an Auto-generated Python SDK for the GeoLens API. Typed clients with Bearer + API-key auth helpers.

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information inadequate authorization checks and improper cache control in multiple endpoints. An attacker can access sensitive data and metadata, including private record contact details, keywords, and distributions, as well as private raster and vector tiles, by sending crafted requests to endpoints that fail to properly enforce access controls or cache private data with public headers. Additional risks include enumeration of non-public dataset titles, server-side request forgery via DNS rebinding in service URL validation, token leakage and header injection through unsanitized environment variables, denial of service by submitting oversized GeoJSON geometries, and exposure of API keys in access logs. This is only exploitable if the deployment does not explicitly set production environment variables or relies on default credentials.

• GitHub Advisory
• GitHub Advisory
• GitHub PR
• GitHub Release