GitHub Advisoryadvisory · PyPI

GHSA-8g38-3m6v-232j Potential log injection in reset user endpoint in CKAN

MEDIUM Published 2024-03-13 Modified 2024-03-13 Official page ↗
Aliases
CVE-2024-27097
Ecosystem
PyPI
Packages
ckan
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-117, CWE-532
Reviewed
2024-03-13

Affected packages

• PyPI ckan: < 2.9.11 → fixed in 2.9.11 • PyPI ckan: >= 2.10.0, < 2.10.4 → fixed in 2.10.4

Description

A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. Patches This has been fixed in the CKAN 2.9.11 and 2.10.4 versions Workarounds Override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines

Related

Alias · CVE (1)

  • CVE-2024-27097 A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. vulnerability

Weakness · CWE (2)

  • CWE-117 Improper Output Neutralization for Logs weakness
  • CWE-532 Insertion of Sensitive Information into Log File weakness

References