PT-2024-29283 · Ops · Ops

Phvalguima · Published 2024-07-22 · Updated 2024-07-24 · CVE-2024-41129

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ops versions prior to 2.15.0

Description The issue arises from the ops library passing secret content as an argument via the command-line interface (CLI). This may affect charms using Juju (>=3.0) and Juju secrets, particularly if they do not correctly capture and process subprocess.CalledProcessError. The vulnerability could lead to the exposure of secrets, such as private keys and passwords, through logs or other means, potentially allowing an attacker to gain privileged access.

Recommendations To resolve the issue, update to version 2.15.0 or later. As a temporary workaround, consider implementing one of the suggested mitigation strategies, such as redacting secret arguments from logs, using temporary files for secrets, or passing secrets through stdin if supported by the secret commands. Restrict access to logs and ensure proper handling of subprocess.CalledProcessError to minimize the risk of secret exposure.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-41129

GHSA-HCMV-JMQH-FJGM

Affected Products

Ops

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41129.json · Exploit
• https://osv.dev/vulnerability/GHSA-hcmv-jmqh-fjgm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41129 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41129 · Vendor Advisory
• https://github.com/canonical/operator · Note
• https://github.com/canonical/operator/commit/fea6d2072435a62170d4c01272572f1a7e916e61 · Note
• https://github.com/canonical/operator/security/advisories/GHSA-hcmv-jmqh-fjgm · Note
• https://t.me/cvenotify/87046 · Telegram Post