Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2024-9606

Improper Output Neutralization for Logs in berriai/litellm

Description

In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

berriai berriai/litellm

  • unspecified to < 1.44.12affected

References