CVE-2024-40647 (published 2024-07-18T17:15Z)

sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the environment variables to be passed to subprocesses despite the `env={}` setting. In Python's `subprocess` calls, all environment variables are passed to subprocesses by default. However, if you specifically do not want them to be passed to subprocesses, you may use `env` argument in `subprocess` calls. Due to the bug in Sentry SDK, with the Stdlib integration enabled (which is enabled by default), this expectation is not fulfilled, and all environment variables are being passed to subprocesses instead. The issue has been patched in pull request #3251 and is included in sentry-sdk==2.8.0. We strongly recommend upgrading to the latest SDK version. However, if it's not possible, and if passing environment variables to child processes poses a security risk for you, you can disable all default integrations.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/getsentry/sentry-python
commit_details: repo_url: https://github.com/getsentry/sentry-python
author: Ivana Kellyer
author_date: 2024-07-08 09:38:14+02:00
msg: fix(integrations): don't send full env to subprocess (#3251)

During the arguments modification to `subprocess.Popen.__init__`,
an explicitly empty environment of `{}` is incorrectly confused with a `None`
environment. This causes sentry to pass the entire environment of the
parent process instead of sending just the injected environment variables.

Fix it by only replacing the environment with `os.environ` if the variable
is None, and not just falsy.

---------

Co-authored-by: Kevin Michel <kevin.michel@aiven.io>
repository: repo_url: https://github.com/getsentry/sentry-python
repo_name: getsentry/sentry-python
description: The official Python SDK for Sentry.io
repo_language: Python
owner: getsentry
file_changes: filename: stdlib.py
change_type: ModificationType.MODIFY
diff: @@ -207,7 +207,11 @@ def _install_subprocess():
             ):
                 if env is None:
                     env = _init_argument(
-                        a, kw, "env", 10, lambda x: dict(x or os.environ)
+                        a,
+                        kw,
+                        "env",
+                        10,
+                        lambda x: dict(x if x is not None else os.environ),
                     )
                 env["SUBPROCESS_" + k.upper().replace("-", "_")] = v
 

programming_language: Python
filename: test_subprocess.py
change_type: ModificationType.MODIFY
diff: @@ -174,6 +174,19 @@ def test_subprocess_basic(
         assert sys.executable + " -c" in subprocess_init_span["description"]
 
 
+def test_subprocess_empty_env(sentry_init, monkeypatch):
+    monkeypatch.setenv("TEST_MARKER", "should_not_be_seen")
+    sentry_init(integrations=[StdlibIntegration()], traces_sample_rate=1.0)
+    with start_transaction(name="foo"):
+        args = [
+            sys.executable,
+            "-c",
+            "import os; print(os.environ.get('TEST_MARKER', None))",
+        ]
+        output = subprocess.check_output(args, env={}, universal_newlines=True)
+    assert "should_not_be_seen" not in output
+
+
 def test_subprocess_invalid_args(sentry_init):
     sentry_init(integrations=[StdlibIntegration()])
 

programming_language: Python