CVE-2024-40647 Unintentional exposure of environment variables to subprocesses in sentry-sdk
The Sentry Python SDK unintentionally exposes environment variables to subprocesses, potentially leaking sensitive data to child processes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-40647?
CVE-2024-40647 is a medium-severity vulnerability in getsentry sentry-python, published on 18 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the environment variables to be passed to subprocesses despite the `env={}` setting. In Python's `subprocess` calls, all environment variables are passed to subprocesses by default. However, if you specifically do not want them to be passed to subprocesses, you may use `env` argument in `subprocess` calls. Due to the bug in Sentry SDK, with the Stdlib integration enabled (which is enabled by default), this expectation is not fulfilled, and all environment variables are being passed to subprocesses instead. The issue has been patched in pull request #3251 and is included in sentry-sdk==2.8.0. We strongly recommend upgrading to the latest SDK version. However, if it's not possible, and if passing environment variables to child processes poses a security risk for you, you can disable all default integrations.
Weakness: CWE-200
Which versions are affected by CVE-2024-40647?
5 open source packages ship an affected version, including sentry-sdk.
| Package | Affected | Fixed in |
|---|---|---|
sentry-sdk PyPI | All versions | 1.45.1, 2.8.0 |
sentry-sdk PyPI | All versions | 1.45.1 |
sentry-sdk PyPI | All versions | 1.45.1 |
sentry-sdk PyPI | From 2.0.0a1 | 2.8.0 |
sentry-sdk PyPI | From 2.0.0a1 | 2.8.0 |
Linux distribution packages (4)
python-sentry-sdk SUSE:Package Hub 15 SP5 | All versions | 0.14.4-bp155.3.3.1 |
python-sentry-sdk openSUSE:Leap 15.5 | All versions | 0.14.4-bp155.3.3.1 |
python-sentry-sdk openSUSE:Tumbleweed | All versions | 2.10.0-1.1 |
python-sentry-sdk openSUSE:Tumbleweed | All versions | 2.66.1-1.1 |
How do I fix CVE-2024-40647?
Upgrade sentry-sdk to a fixed version for your release line: 1.45.1 or 2.8.0.
Is CVE-2024-40647 being exploited?
There is no known exploitation of CVE-2024-40647 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-40647, GHSA-g92j-qhmh-64v2, PYSEC-2026-1917, UBUNTU-CVE-2024-40647, openSUSE-SU-2024:0214-1, openSUSE-SU-2024:14209-1 and 1 more.