PyPI: sentry
CVE-2024-32474
Safety vulnerability ID: SFTY-20240418-69710
Safety legacy ID: pyup.io-71926
When authenticating as a superuser to a self-hosted Sentry instance with a username and password, the password is leaked as cleartext in logs under the event: auth-index.validate_superuser. An attacker with access to the log data could use these leaked credentials to log in to the Sentry system as a superuser.
Overview
Sentry vulnerable to leaking superuser cleartext password in logs
Advisory
When authenticating as a superuser to a self-hosted Sentry instance with a username and password, the password is leaked as cleartext in logs under the event: auth-index.validate_superuser. An attacker with access to the log data could use these leaked credentials to log in to the Sentry system as a superuser.
How to Fix
We recommend updating sentry to the latest non-vulnerable version.
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20240418-69710/CVE-2024-32474
- https://github.com/getsentry/sentry/security/advisories/GHSA-6cjm-4pxw-7xp9
- https://github.com/getsentry/sentry/pull/66393
- https://github.com/getsentry/sentry/pull/69148
- https://github.com/getsentry/sentry/commit/d5b34568d9f1c41362ccb62141532a0a2169512f
- https://nvd.nist.gov/vuln/detail/CVE-2024-32474
- https://github.com/advisories/GHSA-6cjm-4pxw-7xp9
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more