Powertools Lambda Python
Monthly
Fail-open error handling in the Data Masking utility of Powertools for AWS Lambda (Python) before 3.35.0 can cause sensitive field values to be emitted unmasked into logs or storage whenever a masking operation fails at runtime. The flaw (CVSS 5.3, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) is only reachable in applications that actually apply Data Masking to sensitive fields, and only when a masking rule errors - an invalid masking path, a regular expression that cannot be compiled, or a masking-provider failure - after which the original value is returned with nothing more than a warning instead of an exception. There is no public exploit identified at time of analysis; this is a genuine data-confidentiality weakness but a low-urgency one in real terms, because the attacker must also obtain access to the downstream destination (log store or storage) where the unmasked value is written.
Fail-open error handling in the Data Masking utility of Powertools for AWS Lambda (Python) before 3.35.0 can cause sensitive field values to be emitted unmasked into logs or storage whenever a masking operation fails at runtime. The flaw (CVSS 5.3, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) is only reachable in applications that actually apply Data Masking to sensitive fields, and only when a masking rule errors - an invalid masking path, a regular expression that cannot be compiled, or a masking-provider failure - after which the original value is returned with nothing more than a warning instead of an exception. There is no public exploit identified at time of analysis; this is a genuine data-confidentiality weakness but a low-urgency one in real terms, because the attacker must also obtain access to the downstream destination (log store or storage) where the unmasked value is written.