GHSA-2p82-v77v-mppr
Airbrake keys not being filtered
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| RubyGems | airbrake-ruby | >= 4.2.3, < 4.2.4 | 4.2.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may disclose passwords to unauthorized actors. This is fixed in 4.2.4 (also, 4.2.2 and earlier are unaffected).
References
External links from the advisory. They lead to third-party sites.