GitHub Advisoryadvisory · PyPI

GHSA-2rqw-cfhc-35fh CKAN may leak Solr credentials via error message in package_search action

MEDIUM Published 2024-08-21 Modified 2024-08-21 Official page ↗
Aliases
CVE-2024-41674
Ecosystem
PyPI
Packages
ckan
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-209
Reviewed
2024-08-21

Affected packages

• PyPI ckan: >= 2.0.0, < 2.10.5 → fixed in 2.10.5

Description

If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to `package_search` calls as part of the returned error message Patches This has been patched in CKAN 2.10.5 and 2.11.0

Related

Alias · CVE (1)

  • CVE-2024-41674 CKAN is an open-source data management system for powering data hubs and data portals. vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References