GitHub Advisoryadvisory · PyPI

GHSA-879p-8gw4-mcpw fgr Vulnerable to Insecure Default Variable Initialization

LOW Published 2024-03-15 Modified 2024-03-15 Official page ↗
Ecosystem
PyPI
Packages
fgr
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-453
Reviewed
2024-03-15

Affected packages

• PyPI fgr: <= 0.3.2 (no fix yet)

Description

Impact Any users whom would not desire a traceback to be included in their logs whenever an error is raised in their code will be affected. If users have inadvertently created a scenario in their code that could cause a traceback to include sensitive information _and_ a malicious entity gained access to their log stream, this could create an issue. Patches None yet... users will need to upgrade to `0.4.*` Workarounds No particularly reasonable ones at present. References • https://cwe.mitre.org/data/definitions/453.html • https://www.invicti.com/web-vulnerability-scanner/vulnerabilities/stack-trace-disclosure-python/

Related

Weakness · CWE (1)

  • CWE-453 Insecure Default Variable Initialization weakness

References