sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the environment variables to be passed to subprocesses despite the `env={}` setting. In Python's `subprocess` calls, all environment variables are passed to subprocesses by default. However, if you specifically do not want them to be passed to subprocesses, you may use `env` argument in `subprocess` calls. Due to the bug in Sentry SDK, with the Stdlib integration enabled (which is enabled by default), this expectation is not fulfilled, and all environment variables are being passed to subprocesses instead. The issue has been patched in pull request #3251 and is included in sentry-sdk==2.8.0. We strongly recommend upgrading to the latest SDK version. However, if it's not possible, and if passing environment variables to child processes poses a security risk for you, you can disable all default integrations.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4612 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4612-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Santiago Ruano Rincn     May 31, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : sentry-python     Version        : 0.13.2-1+deb11u1     CVE ID         : CVE-2024-40647     Debian Bug     : 1083189

    A vulnerability was found in the Python SDK for Sentry.io  The issue     results in the unintentional exposure of environment variables to     subprocesses despite the env={} setting.

    For Debian 11 bullseye, this problem has been fixed in version     0.13.2-1+deb11u1.

    We recommend that you upgrade your sentry-python packages.

    For the detailed security status of sentry-python please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/sentry-python

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the     environment variables to be passed to subprocesses despite the `env={}` setting. In Python's `subprocess`     calls, all environment variables are passed to subprocesses by default. However, if you specifically do     not want them to be passed to subprocesses, you may use `env` argument in `subprocess` calls. Due to the     bug in Sentry SDK, with the Stdlib integration enabled (which is enabled by default), this expectation is     not fulfilled, and all environment variables are being passed to subprocesses instead. The issue has been     patched in pull request #3251 and is included in sentry-sdk==2.8.0. We strongly recommend upgrading to the     latest SDK version. However, if it's not possible, and if passing environment variables to child processes     poses a security risk for you, you can disable all default integrations. (CVE-2024-40647)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the
    environment variables to be passed to subprocesses despite the `env={}` setting. In Python's `subprocess`
    calls, all environment variables are passed to subprocesses by default. However, if you specifically do
    not want them to be passed to subprocesses, you may use `env` argument in `subprocess` calls. Due to the
    bug in Sentry SDK, with the Stdlib integration enabled (which is enabled by default), this expectation is
    not fulfilled, and all environment variables are being passed to subprocesses instead. The issue has been
    patched in pull request #3251 and is included in sentry-sdk==2.8.0. We strongly recommend upgrading to the
    latest SDK version. However, if it's not possible, and if passing environment variables to child processes
    poses a security risk for you, you can disable all default integrations. (CVE-2024-40647)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2024:0214-1 advisory.

    - CVE-2024-40647: Do not leak environment variables to child processes. (bsc#1228128)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
319493	Debian dla-4612 : python3-sentry-sdk - security update	Nessus	Debian Local Security Checks	low
229470	Linux Distros Unpatched Vulnerability : CVE-2024-40647	Nessus	Misc.	medium
415011	SCA: security update for sentry-sdk (GHSA-g92j-qhmh-64v2)	Tenable Cloud Security	SCA Checks	low
415011	SCA: security update for sentry-sdk (GHSA-g92j-qhmh-64v2)	Tenable Self-Hosted Container Security	SCA Checks	low
204736	openSUSE 15 Security Update : python-sentry-sdk (openSUSE-SU-2024:0214-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-40647

low

Tenable Plugins

low

medium

low

low

medium