CVE-2024-40647: Sentry Python SDK environment variable exposure in subprocesses

Executive brief

A bug in the Sentry Python SDK causes sensitive environment variables to be unintentionally shared with background processes. Even when developers explicitly configure the software to hide these variables, the SDK may leak them, potentially exposing secrets like API keys or database credentials to unauthorized sub-programs. This could lead to data exposure if those background processes are not fully trusted or are logged insecurely.

Technical details

A vulnerability in the Sentry Python SDK's Stdlib integration causes the `env={}` argument in Python `subprocess` calls to be ignored. By default, Python subprocesses inherit all environment variables; developers use `env={}` to prevent this inheritance for security or isolation. Due to this bug, all environment variables are passed to the subprocess regardless of this setting. This occurs when the `StdlibIntegration` is enabled (which is the default). Attackers with the ability to monitor subprocess environments or those who can influence which subprocesses are executed could potentially access sensitive configuration data. The issue is fixed in versions 2.8.0 and 1.45.1.

Affected products

• Sentry sentry-sdk >= 2.0.0a1, < 2.8.0; < 1.45.1

Timeline

• 2024-07-18: advisory: GitHub Advisory GHSA-g92j-qhmh-64v2 published
• 2024-07-18: patched: Fix released in versions 2.8.0 and 1.45.1

References

• https://api.github.com/users/kmichel-aiven
• https://github.com/kmichel-aiven
• https://api.github.com/users/kmichel-aiven/gists%7B/gist_id%7D
• https://api.github.com/users/kmichel-aiven/repos
• https://avatars.githubusercontent.com/u/80679746?v=4
• https://api.github.com/users/kmichel-aiven/events%7B/privacy%7D