GHSA-p3m5-h5v9-vqj6: Pip/ddtrace vulnerability
Summary
A flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default.
Details
The affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input.
If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DDIASTENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application.
Proof of concept
Detailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior.
Impact
Denial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/ddtraceto a version that resolves this vulnerability.Fixed in 4.15.5 - Configuration
Disable IAST by setting DD_IAST_ENABLED=false.
dd-trace-py IAST DD_IAST_ENABLED = false - Compensating control
Replace % string interpolations with str.format or f-strings for user inputs in the monitored application.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Only applications using a vulnerable dd-trace-py version with IAST enabled are affected. IAST is disabled by default, so deployments that have not enabled it are not exposed to this issue.
What must an attacker be able to do to trigger the issue?
The application must perform an affected string-processing operation on attacker-controlled input while IAST is enabled. Successful triggering can terminate the Python application process, resulting in denial of service.
What can be done if upgrading is not immediately possible?
Disable IAST by setting DD_IAST_ENABLED=false. Alternatively, replace replace % string interpolations involving user input in the monitored application with str.format or f-strings.