CVE-2024-9606: Improper Output Neutralization for Logs in berriai/litellm
In berriai/litellm before version 1.44.12, the litellm/litellmcoreutils/litellmlogging.py file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9606?
CVE-2024-9606 is classified as a vulnerability that poses a security risk due to potential exposure of sensitive API keys.
How do I fix CVE-2024-9606?
To fix CVE-2024-9606, upgrade to version 1.44.12 or later of the BerriAI litellm software.
What does CVE-2024-9606 affect?
CVE-2024-9606 affects versions of BerriAI litellm prior to 1.44.12.
What is the cause of CVE-2024-9606?
The cause of CVE-2024-9606 is improper masking of API keys in logs, where only the first five characters are masked.
Who is the vendor for CVE-2024-9606?
The vendor for CVE-2024-9606 is BerriAI, the creator of the litellm software.