Skip to content

Update dependency sentry-sdk to v1 [SECURITY] #369

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update dependency sentry-sdk to v1 [SECURITY] #369

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link

@renovate renovate bot commented Mar 24, 2023 •
edited
Loading

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
sentry-sdk (changelog) ==0.14.3 -> ==1.45.1 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2023-28117

Impact

When using the Django integration of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies values, including the session cookie to Sentry. These sensitive cookies could then be used by someone with access to your Sentry issues to impersonate or escalate their privileges within your application.

The below must be true in order for these sensitive values to be leaked:

  1. Your Sentry SDK configuration has sendDefaultPII set to True
  2. You are using a custom name for either of the cookies below in your Django settings.
  1. You are not configured in your organization or project settings to use our data scrubbing features to account for the custom cookie names

Patches

As of version 1.14.0, the Django integration of the sentry-sdk will detect the custom cookie names based on your Django settings and will remove the values from the payload before sending the data to Sentry.

Workarounds

If you can not update your sentry-sdk to a patched version than you can use the SDKs filtering mechanism to remove the cookies from the payload that is sent to Sentry. For error events this can be done with the before_send callback method and for performance related events (transactions) you can use the before_send_transaction callback method.

If you'd like to handle filtering of these values on the server-side, you can also use our advanced data scrubbing feature to account for the custom cookie names. Look for the $http.cookies, $http.headers, $request.cookies, or $request.headers fields to target with your scrubbing rule.

References

Credits

CVE-2024-40647

Impact

The bug in Sentry's Python SDK <2.8.0 results in the unintentional exposure of environment variables to subprocesses despite the env={} setting.

Details

In Python's subprocess calls, all environment variables are passed to subprocesses by default. However, if you specifically do not want them to be passed to subprocesses, you may use env argument in subprocess calls, like in this example:

>>> subprocess.check_output(["env"], env={"TEST":"1"})
b'TEST=1\n'

If you'd want to not pass any variables, you can set an empty dict:

>>> subprocess.check_output(["env"], env={})
b''

However, the bug in Sentry SDK <2.8.0 causes all environment variables to be passed to the subprocesses when env={} is set, unless the Sentry SDK's Stdlib integration is disabled. The Stdlib integration is enabled by default.

Patches

The issue has been patched in https://github.com/getsentry/sentry-python/pull/3251 and the fix released in sentry-sdk==2.8.0. The fix was also backported to sentry-sdk==1.45.1.

Workarounds

We strongly recommend upgrading to the latest SDK version. However, if it's not possible, and if passing environment variables to child processes poses a security risk for you, there are two options:

  1. In your application, replace env={} with the minimal dict env={"EMPTY_ENV":"1"} or similar.

OR

  1. Disable Stdlib integration:
import sentry_sdk

# Should go before sentry_sdk.init
sentry_sdk.integrations._DEFAULT_INTEGRATIONS.remove("sentry_sdk.integrations.stdlib.StdlibIntegration")

sentry_sdk.init(...)

References

Release Notes

getsentry/sentry-python (sentry-sdk)

v1.45.1

Compare Source

This is a security backport release.

v1.45.0

Compare Source

This is the final 1.x release for the forseeable future. Development will continue on the 2.x release line. The first 2.x version will be available in the next few weeks.

Various fixes & improvements

  • Allow to upsert monitors (#​2929) by @​sentrivana

    It's now possible to provide monitor_config to the monitor decorator/context manager directly:

    from sentry_sdk.crons import monitor

# All keys except `schedule` are optional
monitor_config = {
    "schedule": {"type": "crontab", "value": "0 0 * * *"},
    "timezone": "Europe/Vienna",
    "checkin_margin": 10,
    "max_runtime": 10,
    "failure_issue_threshold": 5,
    "recovery_threshold": 5,
}

@&#8203;monitor(monitor_slug='<monitor-slug>', monitor_config=monitor_config)
def tell_the_world():
    print('My scheduled task...')

    Check out the cron docs for details.

  • Add Django signals_denylist to filter signals that are attached to by signals_spans (#​2758) by @​lieryan

    If you want to exclude some Django signals from performance tracking, you can use the new signals_denylist Django option:

    import django.db.models.signals
import sentry_sdk

sentry_sdk.init(
    ...
    integrations=[
        DjangoIntegration(
            ...
            signals_denylist=[
                django.db.models.signals.pre_init,
                django.db.models.signals.post_init,
            ],
        ),
    ],
)

  • increment for metrics (#​2588) by @​mitsuhiko

    increment and inc are equivalent, so you can pick whichever you like more.

  • Add value, unit to before_emit_metric (#​2958) by @​sentrivana

    If you add a custom before_emit_metric, it'll now accept 4 arguments (the key, value, unit and tags) instead of just key and tags.

    def before_emit(key, value, unit, tags):
    if key == "removed-metric":
        return False
    tags["extra"] = "foo"
    del tags["release"]
    return True

sentry_sdk.init(
    ...
    _experiments={
        "before_emit_metric": before_emit,
    }
)

  • Remove experimental metric summary options (#​2957) by @​sentrivana

    The _experiments options metrics_summary_sample_rate and should_summarize_metric have been removed.

  • New normalization rules for metric keys, names, units, tags (#​2946) by @​sentrivana

  • Change data_category from statsd to metric_bucket (#​2954) by @​cleptric

  • Accessing __mro__ might throw a ValueError (#​2952) by @​sentrivana

  • Suppress prompt spawned by subprocess when using pythonw (#​2936) by @​collinbanko

  • Handle None in GraphQL query #​2715 (#​2762) by @​czyber

  • Do not send "quiet" Sanic exceptions to Sentry (#​2821) by @​hamedsh

  • Implement metric_bucket rate limits (#​2933) by @​cleptric

  • Fix type hints for monitor decorator (#​2944) by @​szokeasaurusrex

  • Remove deprecated typing imports in crons (#​2945) by @​szokeasaurusrex

  • Make monitor_config a TypedDict (#​2931) by @​sentrivana

  • Add devenv-requirements.txt and update env setup instructions (#​2761) by @​arr-ee

  • Bump types-protobuf from 4.24.0.20240311 to 4.24.0.20240408 (#​2941) by @​dependabot

  • Disable Codecov check run annotations (#​2537) by @​eliatcodecov

v1.44.1

Compare Source

Various fixes & improvements

  • Make monitor async friendly (#​2912) by @​sentrivana

    You can now decorate your async functions with the monitor
    decorator and they will correctly report their duration
    and completion status.

  • Fixed Event | None runtime TypeError (#​2928) by @​szokeasaurusrex

v1.44.0

Compare Source

Various fixes & improvements

v1.43.0

Compare Source

Various fixes & improvements

v1.42.0

Compare Source

Various fixes & improvements

  • New integration: OpenAI integration (#​2791) by @​colin-sentry

    We added an integration for OpenAI to capture errors and also performance data when using the OpenAI Python SDK.

    Useage:

    This integrations is auto-enabling, so if you have the openai package in your project it will be enabled. Just initialize Sentry before you create your OpenAI client.

    from openai import OpenAI

import sentry_sdk

sentry_sdk.init(
    dsn="___PUBLIC_DSN___",
    enable_tracing=True,
    traces_sample_rate=1.0,
)

client = OpenAI()

    For more information, see the documentation for OpenAI integration.

  • Discard open OpenTelemetry spans after 10 minutes (#​2801) by @​antonpirker

  • Propagate sentry-trace and baggage headers to Huey tasks (#​2792) by @​cnschn

  • Added Event type (#​2753) by @​szokeasaurusrex

  • Improve scrub_dict typing (#​2768) by @​szokeasaurusrex

  • Dependencies: bump types-protobuf from 4.24.0.20240302 to 4.24.0.20240311 (#​2797) by @​dependabot

v1.41.0

Compare Source

Various fixes & improvements

  • Add recursive scrubbing to EventScrubber (#​2755) by @​Cheapshot003

    By default, the EventScrubber will not search your events for potential
    PII recursively. With this release, you can enable this behavior with:

    import sentry_sdk
from sentry_sdk.scrubber import EventScrubber

sentry_sdk.init(
    # ...your usual settings...
    event_scrubber=EventScrubber(recursive=True),
)

  • Expose socket_options (#​2786) by @​sentrivana

    If the SDK is experiencing connection issues (connection resets, server
    closing connection without response, etc.) while sending events to Sentry,
    tweaking the default urllib3 socket options to the following can help:

    import socket
from urllib3.connection import HTTPConnection
import sentry_sdk

sentry_sdk.init(
    # ...your usual settings...
    socket_options=HTTPConnection.default_socket_options + [
        (socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1),
        # note: skip the following line if you're on MacOS since TCP_KEEPIDLE doesn't exist there
        (socket.SOL_TCP, socket.TCP_KEEPIDLE, 45),
        (socket.SOL_TCP, socket.TCP_KEEPINTVL, 10),
        (socket.SOL_TCP, socket.TCP_KEEPCNT, 6),
    ],
)

  • Allow to configure merge target for releases (#​2777) by @​sentrivana

  • Allow empty character in metric tags values (#​2775) by @​viglia

  • Replace invalid tag values with an empty string instead of _ (#​2773) by @​markushi

  • Add documentation comment to scrub_list (#​2769) by @​szokeasaurusrex

  • Fixed regex to parse version in lambda package file (#​2767) by @​antonpirker

  • xfail broken AWS Lambda tests for now (#​2794) by @​sentrivana

  • Removed print statements because it messes with the tests (#​2789) by @​antonpirker

  • Bump types-protobuf from 4.24.0.20240129 to 4.24.0.20240302 (#​2782) by @​dependabot

  • Bump checkouts/data-schemas from eb941c2 to ed078ed (#​2781) by @​dependabot

v1.40.6

Compare Source

Various fixes & improvements

v1.40.5

Compare Source

Various fixes & improvements

  • Deprecate last_event_id(). (#​2749) by @​antonpirker

  • Warn if uWSGI is set up without proper thread support (#​2738) by @​sentrivana

    uWSGI has to be run in threaded mode for the SDK to run properly. If this is
    not the case, the consequences could range from features not working unexpectedly
    to uWSGI workers crashing.

    Please make sure to run uWSGI with both --enable-threads and --py-call-uwsgi-fork-hooks.

  • parsed_url can be None (#​2734) by @​sentrivana

  • Python 3.7 is not supported anymore by Lambda, so removed it and added 3.12 (#​2729) by @​antonpirker

v1.40.4

Compare Source

Various fixes & improvements

v1.40.3

Compare Source

Various fixes & improvements

v1.40.2

Compare Source

Various fixes & improvements

v1.40.1

Compare Source

Various fixes & improvements

v1.40.0

Compare Source

Various fixes & improvements

v1.39.2

Compare Source

Various fixes & improvements

v1.39.1

Compare Source

Various fixes & improvements

v1.39.0

Compare Source

Various fixes & improvements

v1.38.0

Compare Source

Various fixes & improvements

v1.37.1

Compare Source

Various fixes & improvements

v1.37.0

Compare Source

Various fixes & improvements

v1.36.0

Compare Source

Various fixes & improvements

v1.35.0

Compare Source

Various fixes & improvements

  • Updated gRPC integration: Asyncio interceptors and easier setup (#​2369) by @​fdellekart

    Our gRPC integration now instruments incoming unary-unary grpc requests and outgoing unary-unary, unary-stream grpc requests using grpcio channels. Everything works now for sync and async code.

    Before this release you had to add Sentry interceptors by hand to your gRPC code, now the only thing you need to do is adding the GRPCIntegration to you sentry_sdk_init() call. (See documentation for more information):

    import sentry_sdk
from sentry_sdk.integrations.grpc import GRPCIntegration

sentry_sdk.init(
    dsn="___PUBLIC_DSN___",
    enable_tracing=True,
    integrations=[
        GRPCIntegration(),
    ],
)

    The old way still works, but we strongly encourage you to update your code to the way described above.

  • Python 3.12: Replace deprecated datetime functions (#​2502) by @​sentrivana

  • Metrics: Unify datetime format (#​2409) by @​mitsuhiko

  • Celery: Set correct data in check_ins (#​2500) by @​antonpirker

  • Celery: Read timezone for Crons monitors from celery_schedule if existing (#​2497) by @​antonpirker

  • Django: Removing redundant code in Django tests (#​2491) by @​vagi8

  • Django: Make reading the request body work in Django ASGI apps. (#​2495) by @​antonpirker

  • FastAPI: Use wraps on fastapi request call wrapper (#​2476) by @​nkaras

  • Fix: Probe for psycopg2 and psycopg3 parameters function. (#​2492) by @​antonpirker

  • Fix: Remove unnecessary TYPE_CHECKING alias (#​2467) by @​rafrafek

v1.34.0

Compare Source

Various fixes & improvements

v1.33.1

Compare Source

Various fixes & improvements

v1.33.0

Compare Source

Various fixes & improvements

v1.32.0

Compare Source

Various fixes & improvements

v1.31.0

Compare Source

Various fixes & improvements

  • New: Add integration for clickhouse-driver (#​2167) by @​mimre25

    For more information, see the documentation for clickhouse-driver for more information.

    Usage:

      import sentry_sdk
  from sentry_sdk.integrations.clickhouse_driver import ClickhouseDriverIntegration

  sentry_sdk.init(
      dsn='___PUBLIC_DSN___',
      integrations=[
          ClickhouseDriverIntegration(),
      ],
  )

  • New: Add integration for asyncpg (#​2314) by @​mimre25

    For more information, see the documentation for asyncpg for more information.

    Usage:

      import sentry_sdk
  from sentry_sdk.integrations.asyncpg import AsyncPGIntegration

  sentry_sdk.init(
      dsn='___PUBLIC_DSN___',
      integrations=[
          AsyncPGIntegration(),
      ],
  )

  • New: Allow to override propagate_traces in Celery per task (#​2331) by @​jan-auer

    For more information, see the documentation for Celery for more information.

    Usage:

      import sentry_sdk
  from sentry_sdk.integrations.celery import CeleryIntegration

  # Enable global distributed traces (this is the default, just to be explicit.)
  sentry_sdk.init(
      dsn='___PUBLIC_DSN___',
      integrations=[
          CeleryIntegration(propagate_traces=True),
      ],
  )

  ...

  # This will NOT propagate the trace. (The task will start

Configuration

📅 Schedule: Branch creation - "" in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/pypi-sentry-sdk-vulnerability branch from 1ce4889 to 62b6ec8 Compare July 18, 2024 17:41
@renovate renovate bot changed the title Update dependency sentry-sdk to v1 [SECURITY] Update dependency sentry-sdk to v2 [SECURITY] Jul 18, 2024
@renovate renovate bot force-pushed the renovate/pypi-sentry-sdk-vulnerability branch from 62b6ec8 to 62b1d4e Compare June 7, 2025 02:38
@renovate renovate bot changed the title Update dependency sentry-sdk to v2 [SECURITY] Update dependency sentry-sdk to v1 [SECURITY] Jun 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants