CVE-2024-22194

2.8 lowEPSS 0.4%

Low (2.8) in lfprojects. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in cdo-local-uuid 0.5.0.

cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`.

Severity

CVSS 3.1

2.8 low

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWEs: CWE-215, CWE-337
Published: 2024-01-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

lfprojects:case_python_utilities
lfprojects:cdo_local_uuid_utility

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-rgrf-6mf5-m882	PyPI	cdo-local-uuid	>=0.4.0 <0.5.0	0.5.0
GHSA-rgrf-6mf5-m882	PyPI	case-utils	>=0.5.0 <0.5.1	0.5.1
GHSA-rgrf-6mf5-m882	PyPI	case-utils	>=0.6.0 <0.6.1	0.6.1
GHSA-rgrf-6mf5-m882	PyPI	case-utils	>=0.7.0 <0.7.1	0.7.1
GHSA-rgrf-6mf5-m882	PyPI	case-utils	>=0.8.0 <0.8.1	0.8.1
GHSA-rgrf-6mf5-m882	PyPI	case-utils	>=0.9.0 <0.9.1	0.9.1
GHSA-rgrf-6mf5-m882	PyPI	case-utils	>=0.10.0 <0.10.1	0.10.1
GHSA-rgrf-6mf5-m882	PyPI	case-utils	>=0.11.0 <0.11.1	0.11.1
GHSA-rgrf-6mf5-m882	PyPI	case-utils	>=0.12.0 <0.12.1	0.12.1
GHSA-rgrf-6mf5-m882	PyPI	case-utils	>=0.13.0 <0.13.1	0.13.1
GHSA-rgrf-6mf5-m882	PyPI	case-utils	>=0.14.0 <0.14.1	0.14.1
PYSEC-2024-5	PyPI	case-utils	all versions	no fix published
PYSEC-2024-6	PyPI	cdo-local-uuid	all versions	no fix published

References

Check your stack JSON