CVE-2024-52582CWE-497

cachi2 allows traceback prints locals

Medium · published November 19, 2024

CVSS v3.1
4.7
EPSS
0%
Percentile
7.0
In the wild
Unconfirmed
What it is

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This may uncover secrets if tool used in CI/build pipelines as it's the main use case. Version 0.14.0 contains a patch for the issue. No known workarounds are available.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00178 · 7.0th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2024-11-19T15:32Z
EPSS history
Timeline
  • 19 NOV 15:32Z
    cachi2 allows traceback prints locals
    cvelistv5