id: PYSEC-2023-115
modified: 2023-07-17T20:27:52.414117Z
published: 2023-07-06T23:15:00Z
aliases:
- CVE-2023-36829
- GHSA-4xqm-4p72-87h6
details: 'Sentry is an error tracking and performance monitoring platform. Starting
  in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns
  the `access-control-allow-credentials: true` HTTP header if the `Origin` request
  header ends with the `system.base-hostname` option of Sentry installation. This
  only affects installations that have `system.base-hostname` option explicitly set,
  as it is empty by default. Impact is limited since recent versions of major browsers
  have cross-site cookie blocking enabled by default. However, this flaw could allow
  other multi-step attacks. The patch has been released in Sentry 23.6.2.'
affected:
- package:
    ecosystem: PyPI
    name: sentry
    purl: pkg:pypi/sentry
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: ee44c6be35e5e464bc40637580f39867898acd8b
    repo: https://github.com/getsentry/sentry
  - type: ECOSYSTEM
    events:
    - introduced: 23.6.0
    - fixed: 23.6.2
  versions:
  - 23.6.0
  - 23.6.1
references:
- type: FIX
  url: https://github.com/getsentry/sentry/commit/ee44c6be35e5e464bc40637580f39867898acd8b
- type: FIX
  url: https://github.com/getsentry/sentry/security/advisories/GHSA-4xqm-4p72-87h6
- type: FIX
  url: https://github.com/getsentry/sentry/pull/52276
- type: WEB
  url: https://github.com/getsentry/self-hosted/releases/tag/23.6.2