CVE-2024-22194

Published: Jan 11, 2024Modified: Jun 17, 2026

2.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Exploitability: 1.3 / Impact: 1.4

Source: NVD

Description

cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`.

Affected (11)

Products: Lfprojects: Case Python Utilities, Cdo Local Uuid Utility

2 products

Case Python Utilities

Cdo Local Uuid Utility

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Lfprojects Case Python Utilities	Version 0.10.0
Lfprojects Case Python Utilities	Version 0.11.0
Lfprojects Case Python Utilities	Version 0.12.0
Lfprojects Case Python Utilities	Version 0.13.0
Lfprojects Case Python Utilities	Version 0.14.0
Lfprojects Case Python Utilities	Version 0.5.0
Lfprojects Case Python Utilities	Version 0.6.0
Lfprojects Case Python Utilities	Version 0.7.0
Lfprojects Case Python Utilities	Version 0.8.0
Lfprojects Case Python Utilities	Version 0.9.0
Lfprojects Cdo Local Uuid Utility	Version 0.4.0

Related CWEs

Insertion of Sensitive Information Into Debugging Code

The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

Predictable Seed in Pseudo-Random Number Generator (PRNG)

A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.

References (28)

https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/commit/9e78f7cb1075728d0aafc918514f32a1392cd235

Source: security-advisories@github.com

Patch

https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/pull/3

Source: security-advisories@github.com

Patch

https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/pull/4

Source: security-advisories@github.com

Patch

https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/security/advisories/GHSA-rgrf-6mf5-m882

Source: security-advisories@github.com

ExploitMitigationThird Party Advisory

https://github.com/casework/CASE-Utilities-Python/commit/00864cd12de7c50d882dd1a74915d32e939c25f9

Source: security-advisories@github.com

Patch

https://github.com/casework/CASE-Utilities-Python/commit/1cccae8eb3cf94b3a28f6490efa0fbf5c82ebd6b

Source: security-advisories@github.com

Patch

https://github.com/casework/CASE-Utilities-Python/commit/5acb929dfb599709d1c8c90d1824dd79e0fd9e10

Source: security-advisories@github.com

Patch

https://github.com/casework/CASE-Utilities-Python/commit/7e02d18383eabbeb9fb4ec97d81438c9980a4790

Source: security-advisories@github.com

Patch

https://github.com/casework/CASE-Utilities-Python/commit/80551f49241c874c7c50e14abe05c5017630dad2

Source: security-advisories@github.com

Patch

https://github.com/casework/CASE-Utilities-Python/commit/939775f956796d0432ecabbf62782ed7ad1007b5

Source: security-advisories@github.com

Patch

https://github.com/casework/CASE-Utilities-Python/commit/db428a0745dac4fdd888ced9c52f617695519f9d

Source: security-advisories@github.com

Patch

https://github.com/casework/CASE-Utilities-Python/commit/e4ffadc3d56fd303b8f465d727c4a58213d311a1

Source: security-advisories@github.com

Patch

https://github.com/casework/CASE-Utilities-Python/commit/fca7388f09feccd3b9ea88e6df9c7a43a5349452

Source: security-advisories@github.com

Patch

https://github.com/casework/CASE-Utilities-Python/commit/fdc32414eccfcbde6be0fd91b7f491cc0779b02d#diff-e60b9cb8fb480ed27283a030a0898be3475992d78228f4045b12ce5cbb2f0509

Source: security-advisories@github.com

Patch

https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/commit/9e78f7cb1075728d0aafc918514f32a1392cd235

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/pull/3

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/pull/4

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/security/advisories/GHSA-rgrf-6mf5-m882

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMitigationThird Party Advisory

https://github.com/casework/CASE-Utilities-Python/commit/00864cd12de7c50d882dd1a74915d32e939c25f9

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/casework/CASE-Utilities-Python/commit/1cccae8eb3cf94b3a28f6490efa0fbf5c82ebd6b

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/casework/CASE-Utilities-Python/commit/5acb929dfb599709d1c8c90d1824dd79e0fd9e10

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/casework/CASE-Utilities-Python/commit/7e02d18383eabbeb9fb4ec97d81438c9980a4790

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/casework/CASE-Utilities-Python/commit/80551f49241c874c7c50e14abe05c5017630dad2

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/casework/CASE-Utilities-Python/commit/939775f956796d0432ecabbf62782ed7ad1007b5

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/casework/CASE-Utilities-Python/commit/db428a0745dac4fdd888ced9c52f617695519f9d

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/casework/CASE-Utilities-Python/commit/e4ffadc3d56fd303b8f465d727c4a58213d311a1

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/casework/CASE-Utilities-Python/commit/fca7388f09feccd3b9ea88e6df9c7a43a5349452

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/casework/CASE-Utilities-Python/commit/fdc32414eccfcbde6be0fd91b7f491cc0779b02d#diff-e60b9cb8fb480ed27283a030a0898be3475992d78228f4045b12ce5cbb2f0509

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

Timeline

No history available yet.