GHSA-8g38-3m6v-232j

Potential log injection in reset user endpoint in CKAN

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-27097

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	ckan	< 2.9.11	2.9.11
PyPI	ckan	>= 2.10.0, < 2.10.4	2.10.4

Details

As written in the advisory (Markdown source, shown as plain text).

A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. ### Patches This has been fixed in the CKAN 2.9.11 and 2.10.4 versions ### Workarounds Override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines

References

External links from the advisory. They lead to third-party sites.

https://github.com/ckan/ckan/security/advisories/GHSA-8g38-3m6v-232j web
https://nvd.nist.gov/vuln/detail/CVE-2024-27097 advisory
https://github.com/ckan/ckan/commit/5fa133e7e9019573066455b5d442e93c62b3fc93 web
https://github.com/ckan/ckan/commit/81b56c55e5e3651d7fcf9642cd5a489a9b62212c web
https://github.com/ckan/ckan/commit/d81f411bff2da7347c343a83e17f5814475b5b64 web
https://docs.ckan.org/en/2.10/changelog.html#v-2-10-4-2024-03-13 web
https://github.com/ckan/ckan package