CVE-2024-22194

cdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration code

Severity Score

2.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`.

El proyecto cdo-local-uuid proporciona una función especializada de generación de UUID que puede, a petición del usuario, hacer que un programa genere UUID deterministas. Una vulnerabilidad de fuga de información está presente en `cdo-local-uuid` en la versión `0.4.0`, y en `case-utils` en versiones sin parches (que coinciden con el patrón `0.x.0`) en y desde `0.5. 0`, antes de `0.15.0`. La vulnerabilidad surge de una función de Python, `cdo_local_uuid.local_uuid()`, y su implementación original `case_utils.local_uuid()`.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2024-01-08 CVE Reserved
2024-01-11 CVE Published
2024-01-20 EPSS Updated
2024-08-01 CVE Updated
2024-08-01 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-215: Insertion of Sensitive Information Into Debugging Code
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)

CAPEC

References (14)

URL	Tag	Source

URL	Date	SRC
https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/security/advisories/GHSA-rgrf-6mf5-m882	2024-08-01

URL	Date	SRC
https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/commit/9e78f7cb1075728d0aafc918514f32a1392cd235	2024-01-19
https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/pull/3	2024-01-19
https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/pull/4	2024-01-19
https://github.com/casework/CASE-Utilities-Python/commit/00864cd12de7c50d882dd1a74915d32e939c25f9	2024-01-19
https://github.com/casework/CASE-Utilities-Python/commit/1cccae8eb3cf94b3a28f6490efa0fbf5c82ebd6b	2024-01-19
https://github.com/casework/CASE-Utilities-Python/commit/5acb929dfb599709d1c8c90d1824dd79e0fd9e10	2024-01-19
https://github.com/casework/CASE-Utilities-Python/commit/7e02d18383eabbeb9fb4ec97d81438c9980a4790	2024-01-19
https://github.com/casework/CASE-Utilities-Python/commit/80551f49241c874c7c50e14abe05c5017630dad2	2024-01-19
https://github.com/casework/CASE-Utilities-Python/commit/939775f956796d0432ecabbf62782ed7ad1007b5	2024-01-19
https://github.com/casework/CASE-Utilities-Python/commit/db428a0745dac4fdd888ced9c52f617695519f9d	2024-01-19
https://github.com/casework/CASE-Utilities-Python/commit/e4ffadc3d56fd303b8f465d727c4a58213d311a1	2024-01-19
https://github.com/casework/CASE-Utilities-Python/commit/fca7388f09feccd3b9ea88e6df9c7a43a5349452	2024-01-19
https://github.com/casework/CASE-Utilities-Python/commit/fdc32414eccfcbde6be0fd91b7f491cc0779b02d#diff-e60b9cb8fb480ed27283a030a0898be3475992d78228f4045b12ce5cbb2f0509	2024-01-19

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Lfprojects Search vendor "Lfprojects"		Case Python Utilities Search vendor "Lfprojects" for product "Case Python Utilities"				0.5.0 Search vendor "Lfprojects" for product "Case Python Utilities" and version "0.5.0"		python		Affected
Lfprojects Search vendor "Lfprojects"		Case Python Utilities Search vendor "Lfprojects" for product "Case Python Utilities"				0.6.0 Search vendor "Lfprojects" for product "Case Python Utilities" and version "0.6.0"		python		Affected
Lfprojects Search vendor "Lfprojects"		Case Python Utilities Search vendor "Lfprojects" for product "Case Python Utilities"				0.7.0 Search vendor "Lfprojects" for product "Case Python Utilities" and version "0.7.0"		python		Affected
Lfprojects Search vendor "Lfprojects"		Case Python Utilities Search vendor "Lfprojects" for product "Case Python Utilities"				0.8.0 Search vendor "Lfprojects" for product "Case Python Utilities" and version "0.8.0"		python		Affected
Lfprojects Search vendor "Lfprojects"		Case Python Utilities Search vendor "Lfprojects" for product "Case Python Utilities"				0.9.0 Search vendor "Lfprojects" for product "Case Python Utilities" and version "0.9.0"		python		Affected
Lfprojects Search vendor "Lfprojects"		Case Python Utilities Search vendor "Lfprojects" for product "Case Python Utilities"				0.10.0 Search vendor "Lfprojects" for product "Case Python Utilities" and version "0.10.0"		python		Affected
Lfprojects Search vendor "Lfprojects"		Case Python Utilities Search vendor "Lfprojects" for product "Case Python Utilities"				0.11.0 Search vendor "Lfprojects" for product "Case Python Utilities" and version "0.11.0"		python		Affected
Lfprojects Search vendor "Lfprojects"		Case Python Utilities Search vendor "Lfprojects" for product "Case Python Utilities"				0.12.0 Search vendor "Lfprojects" for product "Case Python Utilities" and version "0.12.0"		python		Affected
Lfprojects Search vendor "Lfprojects"		Case Python Utilities Search vendor "Lfprojects" for product "Case Python Utilities"				0.13.0 Search vendor "Lfprojects" for product "Case Python Utilities" and version "0.13.0"		python		Affected
Lfprojects Search vendor "Lfprojects"		Case Python Utilities Search vendor "Lfprojects" for product "Case Python Utilities"				0.14.0 Search vendor "Lfprojects" for product "Case Python Utilities" and version "0.14.0"		python		Affected
Lfprojects Search vendor "Lfprojects"		Cdo Local Uuid Utility Search vendor "Lfprojects" for product "Cdo Local Uuid Utility"				0.4.0 Search vendor "Lfprojects" for product "Cdo Local Uuid Utility" and version "0.4.0"		python		Affected