2.8

CVE-2024-22194

Exploit

cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lfprojects ≫ Case Python Utilities Version0.5.0 SwPlatformpython
Lfprojects ≫ Case Python Utilities Version0.6.0 SwPlatformpython
Lfprojects ≫ Case Python Utilities Version0.7.0 SwPlatformpython
Lfprojects ≫ Case Python Utilities Version0.8.0 SwPlatformpython
Lfprojects ≫ Case Python Utilities Version0.9.0 SwPlatformpython
Lfprojects ≫ Case Python Utilities Version0.10.0 SwPlatformpython
Lfprojects ≫ Case Python Utilities Version0.11.0 SwPlatformpython
Lfprojects ≫ Case Python Utilities Version0.12.0 SwPlatformpython
Lfprojects ≫ Case Python Utilities Version0.13.0 SwPlatformpython
Lfprojects ≫ Case Python Utilities Version0.14.0 SwPlatformpython
Lfprojects ≫ Cdo Local Uuid Utility Version0.4.0 SwPlatformpython
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.03% 0.057
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 2.8 1.3 1.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
security-advisories@github.com 2.2 0.8 1.4
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CWE-215 Insertion of Sensitive Information Into Debugging Code

The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

CWE-337 Predictable Seed in Pseudo-Random Number Generator (PRNG)

A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.