{"id":"CVE-2024-9606","published":"2025-03-20T10:09:24Z","modified":"2025-03-20T18:55:27Z","title":"Improper Output Neutralization for Logs in berriai/litellm","vendor":"berriai","product":"berriai/litellm","tier":"tail","description":{"text":"In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00767,"percentile":0.55525,"provenance":"source"},"cwes":[{"id":"CWE-117","name":"Improper Output Neutralization for Logs"}],"references":[{"url":"https://huntr.com/bounties/4a03796f-a8d4-4293-84ef-d3959456223a","tags":[]},{"url":"https://github.com/berriai/litellm/commit/9094071c4782183e84f10630e2450be3db55509a","tags":[]}],"priority":{"score":16.4,"factors":[{"name":"EPSS percentile","points":11.11},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"berriai","affectedVersions":[{"vendor":"berriai","product":"berriai/litellm","versions":[">= unspecified, < 1.44.12"]}],"affected":[{"ecosystem":"PyPI","package":"litellm","vulnerableRanges":["<1.44.12"],"patched":["1.44.12"],"from":["GHSA-g5pg-73fc-hjwq","PYSEC-2026-1548"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-6847","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-5710","published":"2024-06-27","fixed":"1.40.15","kev":false},{"cve":"CVE-2024-5751","published":"2024-06-27","fixed":"1.40.16","kev":false},{"cve":"CVE-2024-6587","published":"2024-09-13","fixed":"1.44.8","kev":false,"link":{"from":"CVE-2024-6587","to":"CVE-2024-9606","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:litellm","fromFixed":"1.44.8","toFixed":"1.44.12","daysApart":188}]}},{"cve":"CVE-2024-9606","published":"2025-03-20","fixed":"1.44.12","kev":false},{"cve":"CVE-2024-10188","published":"2025-03-20","fixed":"1.53.1.dev1","kev":false,"link":{"from":"CVE-2024-9606","to":"CVE-2024-10188","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:litellm","fromFixed":"1.44.12","toFixed":"1.53.1.dev1","daysApart":0}]}},{"cve":"CVE-2024-8984","published":"2025-03-20","fixed":"1.56.2","kev":false},{"cve":"CVE-2025-0628","published":"2025-03-20","fixed":"1.61.15","kev":false}],"package":"PyPI:litellm"}}