{"id":"GHSA-2p82-v77v-mppr","summary":"Airbrake keys not being filtered","details":"The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may disclose passwords to unauthorized actors. This is fixed in 4.2.4 (also, 4.2.2 and earlier are unaffected).","aliases":["CVE-2019-16060"],"modified":"2023-11-08T04:01:15.735270Z","published":"2019-09-11T23:05:57Z","database_specific":{"github_reviewed_at":"2019-09-11T22:39:04Z","nvd_published_at":"2019-09-06T19:15:00Z","cwe_ids":["CWE-200"],"severity":"CRITICAL","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16060"},{"type":"WEB","url":"https://github.com/airbrake/airbrake-ruby/issues/468"},{"type":"WEB","url":"https://github.com/airbrake/airbrake-ruby/pull/469/commits/d29925e7838031bf7dea7016b22de52532503796"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/airbrake-ruby/CVE-2019-16060.yml"}],"affected":[{"package":{"name":"airbrake-ruby","ecosystem":"RubyGems","purl":"pkg:gem/airbrake-ruby"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.3"},{"fixed":"4.2.4"}]}],"versions":["4.2.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/09/GHSA-2p82-v77v-mppr/GHSA-2p82-v77v-mppr.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}