loggingredactor leaks PII from custom object __str__ and __repr__ into logs
A Python log-hiding library lets personal data show up in logs.
Summary
The Logging Redactor Python library does not redact personal information returned by custom object __str__ or __repr__ methods, so it appears in logs. Versions before 0.0.7 are affected.
Affected when
- Custom objects whose __str__ or __repr__ returns personal information are logged
- Versions before 0.0.7
What to do
Update to version 0.0.7 or later.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen