GitHub Advisoryadvisory · PyPI

GHSA-59j8-776v-xxxg NoneBot Potential Information Leak in User-Constructed Message Templates

MEDIUM Published 2024-02-09 Modified 2024-02-16 Official page ↗
Aliases
CVE-2024-21624
Ecosystem
PyPI
Packages
nonebot2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-1336, CWE-200
Reviewed
2024-02-09

Affected packages

• PyPI nonebot2: >= 2.0.0a16, < 2.2.0 → fixed in 2.2.0

Description

Impact This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. Patches The identified vulnerability has been remedied in fix #2509 and will be included in versions released after 2.1.3. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. Workarounds A temporary workaround involves filtering underscores before incorporating user input into the message template. References • Pull Request #2509 • CWE-1336

Related

Alias · CVE (1)

  • CVE-2024-21624 nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. vulnerability

Weakness · CWE (2)

  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References