CVE-2019-7617: Elastic APM agent for Python client CGI proxy redirection flaw
(updated )
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.
References
- discuss.elastic.co/t/elastic-apm-agent-for-python-5-1-0-security-update/196145
- github.com/advisories/GHSA-22jh-6gx8-f944
- github.com/elastic/apm-agent-python
- github.com/pypa/advisory-database/tree/main/vulns/elastic-apm/PYSEC-2019-178.yaml
- nvd.nist.gov/vuln/detail/CVE-2019-7617
- www.elastic.co/community/security
Code Behaviors & Features
Detect and mitigate CVE-2019-7617 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →