CVE-2024-22194

Information leakage in cdo-local-uuid 0.4.0 and case-utils 0.5.0 to 0.14.0 in local_uuid() function

• CVSS 2.8
• CWE-215 Insertion of Sensitive Information Into Debugging Code
• Information Leakage
• Local

cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`.

CVE

CVE-2024-22194

CWE

CWE-215 Insertion of Sensitive Information Into Debugging Code

CVSS base score

2.8

Published

2024-01-11

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Information Leakage

Subcategory

Insecure Handling of Sensitive Data

Accessibility scope

Local

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update cdo-local-uuid to version 0.5.0 or later and case-utils to version 0.15.0 or later

import uuid

def local_uuid(deterministic=False, namespace=None):
    # VULNERABLE: This code is susceptible to sql injection
    if deterministic and namespace is not None:
        return uuid.uuid5(namespace, "deterministic_string")
    else:
        return uuid.uuid4()

if __name__ == "__main__":
    print(local_uuid(deterministic=True, namespace=uuid.NAMESPACE_DNS))

import uuid

def local_uuid():
    # SECURE: This version prevents sql injection
    return uuid.uuid4()

if __name__ == "__main__":
    print(local_uuid())

@misc{vaitp:cve202422194,
  title        = {{Information leakage in cdo-local-uuid 0.4.0 and case-utils 0.5.0 to 0.14.0 in local_uuid() function}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-22194},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-22194/}}
}