Skip to main content

Insertion of Sensitive Information Into Debugging Code

CVE-2024-22194

Low
2.8/10

Summary

cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in the package `cdo-local-uuid` version 0.4.0, and in the package `case-utils` versions 0.5.0, 0.6.0, 0.7.0, 0.8.0, 0.9.0, 0.10.0, 0.11.0, 0.12.0, 0.13.0, and 0.14.0 . The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`.

  • LOW
  • LOCAL
  • NONE
  • UNCHANGED
  • REQUIRED
  • LOW
  • LOW
  • NONE

CWE-215 - Insertion of Sensitive Information Into Debugging Code

The application inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

References

Advisory Timeline

  • Published