CVE-2024-27097: 
Python vulnerability analysis and mitigation

CVE-2024-27097 is a security vulnerability discovered in CKAN (versions 2.0 through 2.9.10 and 2.10.0 through 2.10.3) that was disclosed on March 13, 2024. The vulnerability exists in a user endpoint that failed to implement proper filtering on an incoming parameter which was directly added to the application log (GitHub Advisory).

The vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File). The issue received a CVSS v3.1 base score of 5.3 (Medium) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, while GitHub assessed it with a score of 4.3 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability specifically affects the /user/reset endpoint where the id parameter was not properly filtered before being written to log files (NVD).

When exploited, this vulnerability could allow an attacker to inject false log entries or corrupt the log file format, potentially compromising the integrity of system logs (GitHub Advisory).

The vulnerability is exploitable remotely and requires low attack complexity with no privileges required. However, according to GitHub's assessment, user interaction is required for successful exploitation (GitHub Advisory).

The vulnerability has been patched in CKAN versions 2.9.11 and 2.10.4. For users unable to upgrade immediately, a workaround is available by overriding the /user/reset endpoint to filter the id parameter specifically to exclude newlines (GitHub Advisory).