getsentry sentry-python vulnerabilities

Latest getsentry sentry-python CVEs

Newest publication first

1. CVE-2024-40647 Unintentional exposure of environment variables to subprocesses in sentry-sdk

   Published 2024-07-18

   Medium·CVSS 5.3

   sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the environment variables to be passed to subprocesses despite the env={} setting. In Python's subprocess calls, all environment variables are passed to subprocesses by default. Howev...

2. CVE-2023-28117 Sentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True`

   Published 2023-03-22

   Medium·CVSS 6.5 EPSS 0.65%

   Sentry SDK is the official Python SDK for Sentry, real-time crash reporting software. When using the Django integration of versions prior to 1.14.0 of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies values, including the session cookie to Sentr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.