GitHub Advisoryadvisory · PyPI
GHSA-879p-8gw4-mcpw fgr Vulnerable to Insecure Default Variable Initialization
LOW
Official page ↗
- Ecosystem
- PyPI
- Packages
- fgr
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-453
- Reviewed
- 2024-03-15
Affected packages
• PyPI fgr: <= 0.3.2 (no fix yet)
Description
Impact
Any users whom would not desire a traceback to be included in their logs whenever an error is raised in their code will be affected.
If users have inadvertently created a scenario in their code that could cause a traceback to include sensitive information _and_ a malicious entity gained access to their log stream, this could create an issue.
Patches
None yet... users will need to upgrade to `0.4.*`
Workarounds
No particularly reasonable ones at present.
References
• https://cwe.mitre.org/data/definitions/453.html
• https://www.invicti.com/web-vulnerability-scanner/vulnerabilities/stack-trace-disclosure-python/
Related
Weakness · CWE (1)
- CWE-453 Insecure Default Variable Initialization weakness