Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ddtrace | pip | < 4.8.2 | 4.8.2 |
Miggo AIRoot Cause AnalysisThe vulnerability described in the advisory points to an issue in the parsing of W3C baggage headers in dd-trace-py, where item-count and byte-size limits were not enforced on the extraction path. By analyzing the commits between the last vulnerable version (4.8.1) and the patched version (4.8.2), I identified the commit 9c80faa3dcfe238d008c3b3cd0b8e5dfef0aa4cd with the message 'fix: limit baggage header extraction'. This commit modifies the _BaggageHeader._extract function in ddtrace/propagation/http.py. The changes clearly show the addition of logic to limit the number of items and the total size of the parsed baggage header, which directly addresses the described vulnerability. Therefore, the _BaggageHeader._extract function is the vulnerable function.
