CVE-2022-0338: PYSEC-2022-14 - Improper Privilege Management in Conda loguru prior to 0.5.3.

CVE-2022-0338 · Severity: low · CVSS 3.1 · Published 2022-01-25

loguru is a Python logging library widely used to capture application events and troubleshoot issues. A flaw in versions prior to 0.5.3 causes the library to inadvertently log sensitive information (such as credentials or API keys) in clear text, exposing confidential data if logs are accessed or stored insecurely. This could lead to unauthorized access to systems or services if logged secrets are compromised.

Technologies: loguru (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-0338 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-0338 being exploited in the wild.
How severe is CVE-2022-0338?
Low severity, with a CVSS score of 3.1, published 25 January 2022.
Which products and versions are affected?
loguru (PyPI) ECOSYSTEM:introduced=0,fixed=0.5.3, GIT:introduced=0,fixed=ea39375e62f9b8f18e2ca798a5c0fb8c972b7eaa|ECOSYSTEM:introduced=0,fixed=0.5.3.
Is there a fix for CVE-2022-0338?
Yes. loguru (PyPI): upgrade to 0.5.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-0338 attacked?
It is attacked over the network.
Am I affected by CVE-2022-0338?
Check whether you run loguru (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • loguru (PyPI): upgrade to 0.5.3 or later
    pip install "loguru>=0.5.3"

Technical details

loguru prior to version 0.5.3 improperly handles sensitive information, logging it in plaintext where it should be redacted or masked. This is an insertion of sensitive information into log files vulnerability (CWE-532). The issue affects all previous versions up through 0.5.2. The attack vector is network-based with low complexity, and requires authenticated access. An attacker with access to application logs could extract sensitive credentials or secrets to compromise systems. The vulnerability was patched in version 0.5.3 via commit ea39375, which documents security considerations and best practices.

Affected products

  • loguru loguru 0.5.2 and earlier

Identifiers

  • CVE-2022-0338
  • GHSA-39ph-wr67-j4xq
  • PYSEC-2022-14

Timeline

  • 2022-01-26: disclosed
  • 2022-01-26: patched: Fixed in version 0.5.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.