Information Exposure Through Log Files Affecting ops package, versions [2.0.0,2.15.0)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-OPS-7548218
- published 23 Jul 2024
- disclosed 22 Jul 2024
- credit phvalguima
Introduced: 22 Jul 2024
CVE-2024-41129 Open this link in a new tabHow to fix?
Upgrade ops to version 2.15.0 or higher.
Overview
ops is a The Python library behind great charms
Affected versions of this package are vulnerable to Information Exposure Through Log Files through the handling of errors in subprocess.CalledProcessError when executing CLI commands that include sensitive information. An attacker can gain access to sensitive data by exploiting the logging of error details which include secret values.