{"schemaVersion":3,"id":"CVE-2024-22194","aliases":["GHSA-rgrf-6mf5-m882","PYSEC-2024-5","PYSEC-2024-6"],"status":"published","duplicateOf":null,"title":null,"description":"cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`.","dates":{"published":"2024-01-11T02:21:53.758Z","modified":"2025-06-03T14:25:30.740Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":2.8,"severity":"low","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":2.2,"severity":"low","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Pypi","score":2.8,"severity":"low","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","exploitability":3.3,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":2.8,"severity":"low","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0041,"percentile":0.33824,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.0041},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.0041,"percentile":0.33824}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0041,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.0041,"percentile":0.33824}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_CYBER-DOMAIN-ONTOLOGY_CDO-UTILITY-LOCAL-UUID","name":"Cdo Utility Local Uuid","source":"github","url":"https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/security/advisories/GHSA-rgrf-6mf5-m882","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-215","name":"Insertion of Sensitive Information Into Debugging Code","description":"The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/215.html"},{"id":"CWE-337","name":"Predictable Seed in Pseudo-Random Number Generator (PRNG)","description":"A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/337.html"}],"affected":[{"vendor":"cyber-domain-ontology","product":"cdo-utility-local-uuid","name":"CDO-Utility-Local-UUID","label":"cdo-utility-local-uuid","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"= 0.4.0","noFixRecorded":false,"fixedIn":null},{"text":"= 0.5.0","noFixRecorded":false,"fixedIn":null},{"text":"= 0.6.0","noFixRecorded":false,"fixedIn":null},{"text":"= 0.7.0","noFixRecorded":false,"fixedIn":null},{"text":"= 0.8.0","noFixRecorded":false,"fixedIn":null},{"text":"= 0.9.0","noFixRecorded":false,"fixedIn":null},{"text":"= 0.10.0","noFixRecorded":false,"fixedIn":null},{"text":"= 0.11.0","noFixRecorded":false,"fixedIn":null},{"text":"= 0.12.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"= 0.4.0 | = 0.5.0 | = 0.6.0 | = 0.7.0 | = 0.8.0 | = 0.9.0 | = 0.10.0 | = 0.11.0 | = 0.12.0","eol":null,"hubHref":"/vendor/cyber-domain-ontology/cdo-utility-local-uuid"},{"vendor":"lfprojects","product":"case_python_utilities","name":"case python utilities","label":"case_python_utilities","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"0.5.0","noFixRecorded":false,"fixedIn":null},{"text":"0.6.0","noFixRecorded":false,"fixedIn":null},{"text":"0.7.0","noFixRecorded":false,"fixedIn":null},{"text":"0.8.0","noFixRecorded":false,"fixedIn":null},{"text":"0.9.0","noFixRecorded":false,"fixedIn":null},{"text":"0.10.0","noFixRecorded":false,"fixedIn":null},{"text":"0.11.0","noFixRecorded":false,"fixedIn":null},{"text":"0.12.0","noFixRecorded":false,"fixedIn":null},{"text":"0.13.0","noFixRecorded":false,"fixedIn":null},{"text":"0.14.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"0.5.0 | 0.6.0 | 0.7.0 | 0.8.0 | 0.9.0 | 0.10.0 | 0.11.0 | 0.12.0 | 0.13.0 | 0.14.0","eol":null,"hubHref":"/vendor/lfprojects/case_python_utilities"},{"vendor":"lfprojects","product":"cdo_local_uuid_utility","name":"cdo local uuid utility","label":"cdo_local_uuid_utility","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"0.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"0.4.0","eol":null,"hubHref":"/vendor/lfprojects/cdo_local_uuid_utility"},{"vendor":"PyPI","product":"case-utils","name":"case-utils","label":"case-utils","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/case-utils","purlType":"pypi","versions":[{"text":"≥ 0.5.0, < 0.5.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.6.0, < 0.6.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.7.0, < 0.7.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.8.0, < 0.8.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.9.0, < 0.9.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.10.0, < 0.10.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.11.0, < 0.11.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.12.0, < 0.12.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.13.0, < 0.13.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.14.0, < 0.14.1","noFixRecorded":false,"fixedIn":null},{"text":"< 9e78f7cb1075728d0aafc918514f32a1392cd235","noFixRecorded":false,"fixedIn":null},{"text":"< fdc32414eccfcbde6be0fd91b7f491cc0779b02d","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"≥ 0.5.0, < 0.5.1 | ≥ 0.6.0, < 0.6.1 | ≥ 0.7.0, < 0.7.1 | ≥ 0.8.0, < 0.8.1 | ≥ 0.9.0, < 0.9.1 | ≥ 0.10.0, < 0.10.1 | ≥ 0.11.0, < 0.11.1 | ≥ 0.12.0, < 0.12.1 | ≥ 0.13.0, < 0.13.1 | ≥ 0.14.0, < 0.14.1 | < 9e78f7cb1075728d0aafc918514f32a1392cd235 | < fdc32414eccfcbde6be0fd91b7f491cc0779b02d | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"PyPI","product":"cdo-local-uuid","name":"cdo-local-uuid","label":"cdo-local-uuid","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/cdo-local-uuid","purlType":"pypi","versions":[{"text":"≥ 0.4.0, < 0.5.0","noFixRecorded":false,"fixedIn":null},{"text":"< fdc32414eccfcbde6be0fd91b7f491cc0779b02d","noFixRecorded":false,"fixedIn":null},{"text":"< 9e78f7cb1075728d0aafc918514f32a1392cd235","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"≥ 0.4.0, < 0.5.0 | < fdc32414eccfcbde6be0fd91b7f491cc0779b02d | < 9e78f7cb1075728d0aafc918514f32a1392cd235 | All versions (No fix recorded)","eol":null,"hubHref":null}],"affectedCount":5,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/security/advisories/GHSA-rgrf-6mf5-m882","label":"github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/security/advisories/GHSA-rgrf-6mf5-m882","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Advisory","Exploit","Mitigation","Third Party Advisory"]},{"url":"https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/pull/3","label":"github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/pull/3","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","Patch"]},{"url":"https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/pull/4","label":"github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/pull/4","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","Patch"]},{"url":"https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/commit/9e78f7cb1075728d0aafc918514f32a1392cd235","label":"github.com/Cyber-Domain-Ontology/…","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","Patch"]},{"url":"https://github.com/casework/CASE-Utilities-Python/commit/00864cd12de7c50d882dd1a74915d32e939c25f9","label":"github.com/casework/CASE-Utilities-Python/commit/00864cd12de7c50d882dd1a74915d32e939c25f9","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","Patch"]},{"url":"https://github.com/casework/CASE-Utilities-Python/commit/1cccae8eb3cf94b3a28f6490efa0fbf5c82ebd6b","label":"github.com/casework/CASE-Utilities-Python/commit/1cccae8eb3cf94b3a28f6490efa0fbf5c82ebd6b","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","Patch"]},{"url":"https://github.com/casework/CASE-Utilities-Python/commit/5acb929dfb599709d1c8c90d1824dd79e0fd9e10","label":"github.com/casework/CASE-Utilities-Python/commit/5acb929dfb599709d1c8c90d1824dd79e0fd9e10","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","Patch"]},{"url":"https://github.com/casework/CASE-Utilities-Python/commit/7e02d18383eabbeb9fb4ec97d81438c9980a4790","label":"github.com/casework/CASE-Utilities-Python/commit/7e02d18383eabbeb9fb4ec97d81438c9980a4790","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","Patch"]},{"url":"https://github.com/casework/CASE-Utilities-Python/commit/80551f49241c874c7c50e14abe05c5017630dad2","label":"github.com/casework/CASE-Utilities-Python/commit/80551f49241c874c7c50e14abe05c5017630dad2","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","Patch"]},{"url":"https://github.com/casework/CASE-Utilities-Python/commit/939775f956796d0432ecabbf62782ed7ad1007b5","label":"github.com/casework/CASE-Utilities-Python/commit/939775f956796d0432ecabbf62782ed7ad1007b5","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","Patch"]},{"url":"https://github.com/casework/CASE-Utilities-Python/commit/db428a0745dac4fdd888ced9c52f617695519f9d","label":"github.com/casework/CASE-Utilities-Python/commit/db428a0745dac4fdd888ced9c52f617695519f9d","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","Patch"]},{"url":"https://github.com/casework/CASE-Utilities-Python/commit/e4ffadc3d56fd303b8f465d727c4a58213d311a1","label":"github.com/casework/CASE-Utilities-Python/commit/e4ffadc3d56fd303b8f465d727c4a58213d311a1","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","Patch"]},{"url":"https://github.com/casework/CASE-Utilities-Python/commit/fca7388f09feccd3b9ea88e6df9c7a43a5349452","label":"github.com/casework/CASE-Utilities-Python/commit/fca7388f09feccd3b9ea88e6df9c7a43a5349452","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","Patch"]},{"url":"https://github.com/casework/CASE-Utilities-Python/commit/fdc32414eccfcbde6be0fd91b7f491cc0779b02d#diff-e60b9cb8fb480ed27283a030a0898be3475992d78228f4045b12ce5cbb2f0509","label":"github.com/casework/CASE-Utilities-Python/commit/fdc32414eccfcbde6be0fd91b7f491cc0779b02d","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22194","label":"nvd.nist.gov/vuln/detail/CVE-2024-22194","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/case-utils/PYSEC-2024-5.yaml","label":"github.com/pypa/advisory-database/tree/main/vulns/case-utils/PYSEC-2024-5.yaml","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/cdo-local-uuid/PYSEC-2024-6.yaml","label":"github.com/pypa/advisory-database/tree/main/vulns/cdo-local-uuid/PYSEC-2024-6.yaml","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID","label":"github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2024-01-11T02:21:53.758Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-06-03T14:25:30.740Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":21,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T05:25:31.619Z","stale":false,"partial":false}}