CVE-2024-41129

Published: Jul 22, 2024Modified: Jun 17, 2026Deferred

4.4

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 0.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of the args via CLI. This issue may affect any of the charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing `subprocess.CalledProcessError`. This vulnerability is fixed in 2.15.0.

Related CWEs

CWE-532

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (4)

https://github.com/canonical/operator/commit/fea6d2072435a62170d4c01272572f1a7e916e61

Source: security-advisories@github.com

https://github.com/canonical/operator/security/advisories/GHSA-hcmv-jmqh-fjgm

Source: security-advisories@github.com

https://github.com/canonical/operator/commit/fea6d2072435a62170d4c01272572f1a7e916e61

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/canonical/operator/security/advisories/GHSA-hcmv-jmqh-fjgm

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.