{"id":"GHSA-879p-8gw4-mcpw","aliases":[],"status":"published","title":"fgr Vulnerable to Insecure Default Variable Initialization","description":"### Impact\nAny users whom would not desire a traceback to be included in their logs whenever an error is raised in their code will be affected.\n\nIf users have inadvertently created a scenario in their code that could cause a traceback to include sensitive information _and_ a malicious entity gained access to their log stream, this could create an issue.\n\n### Patches\nNone yet... users will need to upgrade to `0.4.*`\n\n### Workarounds\nNo particularly reasonable ones at present.\n\n### References\n* https://cwe.mitre.org/data/definitions/453.html\n* https://www.invicti.com/web-vulnerability-scanner/vulnerabilities/stack-trace-disclosure-python/","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-453"],"published":"2024-03-15T19:01:10Z","modified":"2024-12-04T05:40:18Z","affected":[{"source":"ghsa","ecosystem":"PyPI","package":"fgr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.3.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"fgr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.3.2"}]}],"versions":["0.1.4","0.1.5","0.1.6","0.1.7","0.1.7rc1","0.2.0","0.2.0rc1","0.2.1","0.3.0","0.3.0rc1","0.3.0rc2","0.3.1","0.3.2","0.3.2rc1","0.3.2rc2"]}],"references":[{"url":"https://github.com/dan1hc/fgr/security/advisories/GHSA-879p-8gw4-mcpw","tags":["web"]},{"url":"https://github.com/advisories/GHSA-879p-8gw4-mcpw"},{"url":"https://github.com/dan1hc/fgr","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-879p-8gw4-mcpw","title":" fgr Vulnerable to Insecure Default Variable Initialization","description":"### Impact\nAny users whom would not desire a traceback to be included in their logs whenever an error is raised in their code will be affected.\n\nIf users have inadvertently created a scenario in their code that could cause a traceback to include sensitive information _and_ a malicious entity gained access to their log stream, this could create an issue.\n\n### Patches\nNone yet... users will need to upgrade to `0.4.*`\n\n### Workarounds\nNo particularly reasonable ones at present.\n\n### References\n* https://cwe.mitre.org/data/definitions/453.html\n* https://www.invicti.com/web-vulnerability-scanner/vulnerabilities/stack-trace-disclosure-python/","status":"published","published":"2024-03-15T19:01:10Z","modified":"2024-03-15T19:01:11Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-453"],"updated_at":"2026-11-02T14:37:40.81935Z"}],"osv":[{"id":"GHSA-879p-8gw4-mcpw","title":" fgr Vulnerable to Insecure Default Variable Initialization","description":"### Impact\nAny users whom would not desire a traceback to be included in their logs whenever an error is raised in their code will be affected.\n\nIf users have inadvertently created a scenario in their code that could cause a traceback to include sensitive information _and_ a malicious entity gained access to their log stream, this could create an issue.\n\n### Patches\nNone yet... users will need to upgrade to `0.4.*`\n\n### Workarounds\nNo particularly reasonable ones at present.\n\n### References\n* https://cwe.mitre.org/data/definitions/453.html\n* https://www.invicti.com/web-vulnerability-scanner/vulnerabilities/stack-trace-disclosure-python/","status":"published","published":"2024-03-15T19:01:10Z","modified":"2024-12-04T05:40:18.796535Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-453"],"updated_at":"2026-11-02T15:46:42.077781Z"}]}}