Zipline 4.2.0 before 4.6.2 OAuth2 Client Secret Leakage in Startup Logs
Summary
Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTH_OIDC_CLIENT_SECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to ex...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| dicedzipline |
≥ 4.2.0, < 4.6.2→ 4.6.2 |
4.6.2 |
Original description The description as published by the source.
Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTH_OIDC_CLIENT_SECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to exchange intercepted OAuth2 callbacks for valid tokens.
Source: CVE.org (CVE Program・cvelistV5) NVD