Skip to content
OpenAdvisories
High · 7.3 CVE-2024-32474 EUVD-2024-1123GHSA-6cjm-4pxw-7xp9PYSEC-2026-1911

Sentry's superuser cleartext password leaked in logs

Published Apr 18, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Description

Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the _event_: `auth-index.validate_superuser`. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser. Self-hosted users on affected versions should upgrade to 24.4.1 or later. Users can configure the logging level to exclude logs of the `INFO` level and only generate logs for levels at `WARNING` or more.

Affected products

VendorProductAffectedFixed
getsentry sentry >= 24.3.0, < 24.4.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI sentry >= 24.3.0, < 24.4.1 24.4.1 GHSA-6cjm-4pxw-7xp9

References