CVE-2024-41129CWE-532

The ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command

Medium · published July 22, 2024

CVSS v3.1
4.4
EPSS
0%
Percentile
9.1
In the wild
Unconfirmed
What it is

The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of the args via CLI. This issue may affect any of the charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing `subprocess.CalledProcessError`. This vulnerability is fixed in 2.15.0.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00198 · 9.1th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2024-07-22T14:20Z
EPSS history
Timeline
  • 22 JUL 14:20Z
    The ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
    cvelistv5