Skip to content

Bump sentry-sdk to 2.8.0 [SECURITY]#520

Open
renovate[bot] wants to merge 1 commit into
3.1from
renovate/pypi-sentry-sdk-vulnerability
Open

Bump sentry-sdk to 2.8.0 [SECURITY]#520
renovate[bot] wants to merge 1 commit into
3.1from
renovate/pypi-sentry-sdk-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Jul 18, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
sentry-sdk (changelog) ==2.0.1 → ==2.8.0 age confidence

Sentry's Python SDK unintentionally exposes environment variables to subprocesses

CVE-2024-40647 / GHSA-g92j-qhmh-64v2

More information

Details

Impact

The bug in Sentry's Python SDK <2.8.0 results in the unintentional exposure of environment variables to subprocesses despite the env={} setting.

Details

In Python's subprocess calls, all environment variables are passed to subprocesses by default. However, if you specifically do not want them to be passed to subprocesses, you may use env argument in subprocess calls, like in this example:

>>> subprocess.check_output(["env"], env={"TEST":"1"})
b'TEST=1\n'

If you'd want to not pass any variables, you can set an empty dict:

>>> subprocess.check_output(["env"], env={})
b''

However, the bug in Sentry SDK <2.8.0 causes all environment variables to be passed to the subprocesses when env={} is set, unless the Sentry SDK's Stdlib integration is disabled. The Stdlib integration is enabled by default.

Patches

The issue has been patched in https://github.com/getsentry/sentry-python/pull/3251 and the fix released in sentry-sdk==2.8.0. The fix was also backported to sentry-sdk==1.45.1.

Workarounds

We strongly recommend upgrading to the latest SDK version. However, if it's not possible, and if passing environment variables to child processes poses a security risk for you, there are two options:

  1. In your application, replace env={} with the minimal dict env={"EMPTY_ENV":"1"} or similar.

OR

  1. Disable Stdlib integration:
import sentry_sdk

##### Should go before sentry_sdk.init
sentry_sdk.integrations._DEFAULT_INTEGRATIONS.remove("sentry_sdk.integrations.stdlib.StdlibIntegration")

sentry_sdk.init(...)
References

Severity

  • CVSS Score: 1.8 / 10 (Low)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

getsentry/sentry-python (sentry-sdk)

v2.8.0

Compare Source

Various fixes & improvements

v2.7.1

Compare Source

Various fixes & improvements

v2.7.0

Compare Source

v2.6.0

Compare Source

v2.5.1

Compare Source

This change fixes a regression in our cron monitoring feature, which caused cron checkins not to be sent. The regression appears to have been introduced in version 2.4.0.

We recommend that all users, who use Cron monitoring and are currently running sentry-python ≥2.4.0, upgrade to this release as soon as possible!

Other fixes & improvements

v2.5.0

Compare Source

Various fixes & improvements

  • Allow to configure status codes to report to Sentry in Starlette and FastAPI (#​3008) by @​sentrivana

    By passing a new option to the FastAPI and Starlette integrations, you're now able to configure what
    status codes should be sent as events to Sentry. Here's how it works:

    from sentry_sdk.integrations.starlette import StarletteIntegration
from sentry_sdk.integrations.fastapi import FastApiIntegration

sentry_sdk.init(
    # ...
    integrations=[
        StarletteIntegration(
            failed_request_status_codes=[403, range(500, 599)],
        ),
        FastApiIntegration(
            failed_request_status_codes=[403, range(500, 599)],
        ),
    ]
)

    failed_request_status_codes expects a list of integers or containers (objects that allow membership checks via in)
    of integers. Examples of valid failed_request_status_codes:

    • [500] will only send events on HTTP 500.
    • [400, range(500, 599)] will send events on HTTP 400 as well as the 500-599 range.
    • [500, 503] will send events on HTTP 500 and 503.

    The default is [range(500, 599)].

    See the FastAPI and Starlette integration docs for more details.

  • Support multiple keys with cache_prefixes (#​3136) by @​sentrivana

  • Support integer Redis keys (#​3132) by @​sentrivana

  • Update SDK version in CONTRIBUTING.md (#​3129) by @​sentrivana

  • Bump actions/checkout from 4.1.4 to 4.1.5 (#​3067) by @​dependabot

v2.4.0

Compare Source

Various fixes & improvements

v2.3.1

Compare Source

Various fixes & improvements

v2.3.0

Compare Source

Various fixes & improvements

v2.2.1

Compare Source

Various fixes & improvements

v2.2.0

Compare Source

New features
  • Celery integration now sends additional data to Sentry to enable new features to guage the health of your queues
  • Added a new integration for Cohere
  • Reintroduced the last_event_id function, which had been removed in 2.0.0
Other fixes & improvements

v2.1.1

Compare Source

v2.1.0

Compare Source

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot force-pushed the renovate/pypi-sentry-sdk-vulnerability branch from 3b5ceff to c8d6419 Compare August 10, 2025 15:07
@renovate renovate Bot changed the title Bump sentry-sdk to 2.8.0 [SECURITY] Bump sentry-sdk to 2.8.0 [SECURITY] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate renovate Bot deleted the renovate/pypi-sentry-sdk-vulnerability branch March 27, 2026 01:57
@renovate renovate Bot changed the title Bump sentry-sdk to 2.8.0 [SECURITY] - autoclosed Bump sentry-sdk to 2.8.0 [SECURITY] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate renovate Bot force-pushed the renovate/pypi-sentry-sdk-vulnerability branch 2 times, most recently from c8d6419 to e16f5ae Compare March 30, 2026 17:35
@renovate renovate Bot changed the title Bump sentry-sdk to 2.8.0 [SECURITY] Bump sentry-sdk to 2.8.0 [SECURITY] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot changed the title Bump sentry-sdk to 2.8.0 [SECURITY] - autoclosed Bump sentry-sdk to 2.8.0 [SECURITY] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate renovate Bot force-pushed the renovate/pypi-sentry-sdk-vulnerability branch 2 times, most recently from e16f5ae to 9c2e7e2 Compare April 27, 2026 21:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants