CVE-2019-16060 - The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may disclose passwords to unauthorized actors

Back Back to CVE browser

CRITICAL

The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may disclose passwords to unauthorized actors

Published Sep 6, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 1.44%

Description

The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may disclose passwords to unauthorized actors. This is fixed in 4.2.4 (also, 4.2.2 and earlier are unaffected).

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0647
Advisory
https://github.com/advisories/GHSA-2p82-v77v-mppr
Advisory
https://github.com/airbrake/airbrake-ruby/issues/468
x_refsource_MISCIssue TrackingPatchThird Party Advisory
https://github.com/airbrake/airbrake-ruby/pull/469/commits/d29925e7838031bf7dea7016b22de52532503796
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/airbrake-ruby/CVE-2019-16060.yml
https://nvd.nist.gov/vuln/detail/CVE-2019-16060

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0647		Advisory
https://github.com/advisories/GHSA-2p82-v77v-mppr		Advisory
https://github.com/airbrake/airbrake-ruby/issues/468		x_refsource_MISCIssue TrackingPatchThird Party Advisory
https://github.com/airbrake/airbrake-ruby/pull/469/commits/d29925e7838031bf7dea7016b22de52532503796
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/airbrake-ruby/CVE-2019-16060.yml
https://nvd.nist.gov/vuln/detail/CVE-2019-16060