| Package | Affected versions | Patched versions |
|---|---|---|
| airbrake-ruby | ≥ 4.2.3, < 4.2.4 | 4.2.4 |
| airbrake ruby | = 4.2.3 |
The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may disclose passwords to unauthorized actors. This is fixed in 4.2.4 (also, 4.2.2 and earlier are unaffected).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free