Zipline 4.2.0 before 4.6.2 OAuth2 Client Secret Leakage in Startup Logs
概要
Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTH_OIDC_CLIENT_SECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to ex...
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| dicedzipline |
4.2.0 以上 4.6.2 未満→ 4.6.2 |
4.6.2 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTH_OIDC_CLIENT_SECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to exchange intercepted OAuth2 callbacks for valid tokens.
出典: CVE.org (CVE Program・cvelistV5) NVD