CVE-2024-22194 cdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration code
The library leaks the developer's current working directory in generated UUIDs, exposing local file paths to attackers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-22194?
CVE-2024-22194 is a low-severity vulnerability in Cyber-Domain-Ontology CDO-Utility-Local-UUID, published on 11 Jan 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`.
Which versions are affected by CVE-2024-22194?
24 open source packages ship an affected version, including case-utils and cdo-local-uuid. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
case-utils PyPI | All versions | None |
case-utils PyPI | From 0.10.0 | 0.10.1 |
case-utils PyPI | From 0.10.0 | 0.10.1 |
case-utils PyPI | From 0.11.0 | 0.11.1 |
case-utils PyPI | From 0.11.0 | 0.11.1 |
case-utils PyPI | From 0.12.0 | 0.12.1 |
18 more packages
case-utils PyPI | From 0.12.0 | 0.12.1 |
case-utils PyPI | From 0.13.0 | 0.13.1 |
case-utils PyPI | From 0.13.0 | 0.13.1 |
case-utils PyPI | From 0.14.0 | 0.14.1 |
case-utils PyPI | From 0.14.0 | 0.14.1 |
case-utils PyPI | From 0.5.0 | 0.5.1 |
case-utils PyPI | From 0.5.0 | 0.5.1 |
case-utils PyPI | From 0.6.0 | 0.6.1 |
case-utils PyPI | From 0.6.0 | 0.6.1 |
case-utils PyPI | From 0.7.0 | 0.7.1 |
case-utils PyPI | From 0.7.0 | 0.7.1 |
case-utils PyPI | From 0.8.0 | 0.8.1 |
case-utils PyPI | From 0.8.0 | 0.8.1 |
case-utils PyPI | From 0.9.0 | 0.9.1 |
case-utils PyPI | From 0.9.0 | 0.9.1 |
cdo-local-uuid PyPI | All versions | None |
cdo-local-uuid PyPI | From 0.4.0 | 0.5.0 |
cdo-local-uuid PyPI | From 0.4.0 | 0.5.0 |
Products include Lfprojects Case Python Utilities, Lfprojects Cdo Local Uuid Utility.
How do I fix CVE-2024-22194?
Upgrade case-utils to a fixed version for your release line: 0.10.1, 0.11.1, 0.12.1 or 0.13.1.
Is CVE-2024-22194 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-22194 exists.
Sources
Also known as GHSA-rgrf-6mf5-m882, PYSEC-2024-5, PYSEC-2024-6.