Potential log injection in reset user endpoint in CKAN
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format.
Patches
This has been fixed in the CKAN 2.9.11 and 2.10.4 versions
Workarounds
Override the /user/reset endpoint to filter the id parameter in order to exclude newlines
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | ckan | < 2.9.11, >= 2.10.0, < 2.10.4 | 2.9.11, 2.10.4 |
References
- https://github.com/ckan/ckan/security/advisories/GHSA-8g38-3m6v-232j
- https://nvd.nist.gov/vuln/detail/CVE-2024-27097
- https://github.com/ckan/ckan/commit/5fa133e7e9019573066455b5d442e93c62b3fc93
- https://github.com/ckan/ckan/commit/81b56c55e5e3651d7fcf9642cd5a489a9b62212c
- https://github.com/ckan/ckan/commit/d81f411bff2da7347c343a83e17f5814475b5b64
- https://docs.ckan.org/en/2.10/changelog.html#v-2-10-4-2024-03-13
- https://github.com/ckan/ckan
- https://pypi.org/project/ckan
- https://github.com/advisories/GHSA-8g38-3m6v-232j
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N- Weakness (CWE)
CWE-117, CWE-532- Platform
- Python (PyPI)
- Package
ckan- Disclosed
- 13.03.2024
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1251 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-8g38-3m6v-232j - CC BY 4.0
Vulnerability history: ckan
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 15
- First → latest
- 12.2021 04.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 3
- Medium 11
Disclosures per year
- 2021: 1
- 2022: 1
- 2023: 2
- 2024: 4
- 2025: 3
- 2026: 4
-
Potential log injection in reset user endpoint in CKAN this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.