Listen to this Post
The vulnerability in loggingredactor occurs when the library processes log entries containing non-string data types (like integers, dicts) with format specifiers expecting strings. During redaction, the code improperly converts all values to strings, breaking type-specific format operations. When a `%d` conversion specifier encounters a stringified number (e.g., `”123″` instead of 123), a `TypeError` is raised because `%d` expects an integer, not a string. This type mismatch can crash logging operations, potentially disrupting application monitoring and error reporting if the logging call is not properly wrapped in exception handling. The issue was rooted in the redaction function’s lack of type preservation for mapped values.
Platform: loggingredactor
Version: <0.0.6
Vulnerability: Type conversion error
Severity: Medium
Date: 2025-01-03
Prediction: Patched 2025-01-03
What Undercode Say:
pip install loggingredactor==0.0.5
import loggingredactor
redactor = loggingredactor.Redactor(patterns=['secret'])
This may cause a TypeError with %d after redaction
log_entry = {"user_id": 456, "key": "secret123"}
result = redactor.redact(log_entry)
print("User ID: %d" % result['user_id'])
How Exploit:
Trigger `TypeError` exceptions.
Disrupt application logging.
Crash dependent services.
Protection from this CVE
Upgrade to version 0.0.6.
Apply the official patch.
Validate input types.
Impact:
Logging system crashes.
Loss of log data.
Service disruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
