Description
Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| DataDog | dd-trace-py | >= 3.13.0, < 4.15.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | datadog-agent-7.78-core-integrations +2 | No fix yet | — |
| Wolfi rolling | datadog-agent-7.79-core-integrations | 7.79.2-r31 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ddtrace | >= 3.13.0, < 4.15.5 | 4.15.5 | GHSA-p3m5-h5v9-vqj6 |
References
- https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-p3m5-h5v9-vqj6
- https://github.com/DataDog/dd-trace-py/pull/20786
- https://github.com/DataDog/dd-trace-py/pull/20823
- https://github.com/DataDog/dd-trace-py/commit/69dc19853247434ceab83e0c1c4e279a2eb2a3f7
- https://github.com/DataDog/dd-trace-py/commit/ace972489b57dd020ff52b706bb548a354f2dd69
- https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5