PT-2024-40441 · Datadog · Datadog/Dd-Trace

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions datadog/dd-trace versions 0.30.0 through 0.30.1

Description The issue concerns a security and stability problem where the ddtrace.request init hook was not properly bound by the open basedir INI directive, potentially leading to vulnerabilities related to open basedir restrictions. The problem has been addressed by introducing a sandboxing mechanism to isolate the request init hook from errors or exceptions during execution, thus enhancing the library's stability and preventing adverse impacts on the main script.

Recommendations For datadog/dd-trace versions 0.30.0 through 0.30.1, update to version 0.30.2 or later to resolve the issue.

Related Identifiers

GHSA-QVGG-R6RQ-VWFX

Affected Products

Datadog/Dd-Trace

References · 7

• https://osv.dev/vulnerability/GHSA-qvgg-r6rq-vwfx · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/datadog/dd-trace/2019-09-26-1.yaml · Note
• https://github.com/DataDog/dd-trace-php/releases/tag/0.30.2 · Note
• https://github.com/DataDog/dd-trace-php/releases/tag/0.30.0 · Note
• https://github.com/DataDog/dd-trace-php · Note
• https://github.com/DataDog/dd-trace-php/pull/579 · Note
• https://github.com/DataDog/dd-trace-php/commit/87fc324eb63d533b35464f1dfca946795f2294fd · Note