Vulnerability · Published Jul 18, 2024 · Assigned by GitHub_M
CVE-2024-40647Unintentional exposure of environment variables to subprocesses in sentry-sdk
Medium 5.3
In plain English
A medium-severity information exposure in sentry-python from getsentry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the environment variables to be passed to subprocesses despite the `env={}` setting. In Python's `subprocess` calls, all environment variables are passed to subprocesses by default. However, if you specifically do not want them to be passed to subprocesses, you may use `env` argument in `subprocess` calls. Due to the bug in Sentry SDK, with the Stdlib integration enabled (which is enabled by default), this expectation is not fulfilled, and all environment variables are being passed to subprocesses instead. The issue has been patched in pull request #3251 and is included in sentry-sdk==2.8.0. We strongly recommend upgrading to the latest SDK version. However, if it's not possible, and if passing environment variables to child processes poses a security risk for you, you can disable all default integrations.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | sentry-python | 1.9.10-2+deb12u1 | DEBIAN-CVE-2024-40647 |
| Debian:13 | sentry-python | 2.16.0-1 | DEBIAN-CVE-2024-40647 |
| Debian:14 | sentry-python | 2.16.0-1 | DEBIAN-CVE-2024-40647 |
| PyPI | sentry-sdk | 2.8.0 | GHSA-g92j-qhmh-64v2 |
| PyPI | sentry-sdk | 1.45.1 | GHSA-g92j-qhmh-64v2 |
| PyPI | sentry-sdk | 1.45.1, 2.8.0 | PYSEC-2026-1917 |
| Ubuntu:22.04:LTS | sentry-python | no fix listed | UBUNTU-CVE-2024-40647 |
| Ubuntu:24.04:LTS | sentry-python | no fix listed | UBUNTU-CVE-2024-40647 |
| Ubuntu:25.10 | sentry-python | no fix listed | UBUNTU-CVE-2024-40647 |
| Ubuntu:26.04:LTS | sentry-python | no fix listed | UBUNTU-CVE-2024-40647 |
| Ubuntu:26.10 | sentry-python | no fix listed | UBUNTU-CVE-2024-40647 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| getsentry | sentry-python | < 2.8.0 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
References
- https://github.com/getsentry/sentry-python/security/advisories/GHSA-g92j-qhmh-64v2 x_refsource_CONFIRM
- https://github.com/getsentry/sentry-python/pull/3251 x_refsource_MISC
- https://github.com/getsentry/sentry-python/commit/763e40aa4cb57ecced467f48f78f335c87e9bdff x_refsource_MISC
- https://docs.python.org/3/library/subprocess.html x_refsource_MISC
- https://docs.sentry.io/platforms/python/integrations/default-integrations x_refsource_MISC
- https://docs.sentry.io/platforms/python/integrations/default-integrations/#stdlib x_refsource_MISC
- https://github.com/getsentry/sentry-python/releases/tag/2.8.0 x_refsource_MISC
- https://lists.debian.org/debian-lts-announce/2026/06/msg00001.html