GHSA-7cjh-xx4r-qh3f: Sentry android Sentry-android Unmasked Sensitive Data Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7cjh-xx4r-qh3f",
  "modified" : "2025-06-20T19:27:36Z",
  "published" : "2025-06-20T13:28:26Z",
  "aliases" : [ ],
  "summary" : "sentry-android unmasked sensitive data in Android Session Replays for users of Jetpack Compose 1.8+",
  "details" : "### Impact\n\nUnder specific circumstances, text composables may contain unmasked sensitive data in Android session replays.  You may be impacted if you meet the following conditions:\n- Using any `sentry-android` with versions < 8.14.0 \n- Using Jetpack Compose >= [1.8.0-alpha08](https://developer.android.com/jetpack/androidx/releases/compose-ui#1.8.0-alpha08)\n  - This includes any alpha, beta, release candidate, or general availability after this version\n- Have configured Sentry Session Replays for Android\n\n> [!IMPORTANT] \n> If you do not use Jetpack Compose or have never used a version >= 1.8.0-alpha08 you are not impacted. \n\n> [!IMPORTANT] \n> If you have not configured [Session Replays for Mobile](https://docs.sentry.io/product/explore/session-replay/mobile/) you are not impacted.\n\n### How do I check if I'm impacted?\n\nIf you meet the conditions above, the `sentry-android` package includes a [specific error log](https://github.com/getsentry/sentry-java/blob/b2920907e6afb69a8027cedb251dd94a3514f0e6/sentry-android-replay/src/main/java/io/sentry/android/replay/viewhierarchy/ComposeViewHierarchyNode.kt#L252-L261) that would indicate you may be impacted. Customers may use [logcat](https://developer.android.com/tools/logcat) to search for this event.\n\n### I'm impacted and want this data deleted\n\nIf you've confirmed that you're affected and unmasked sensitive data in Session Replays have reached Sentry servers, you can please see this documentation on [deleting individual replays](https://docs.sentry.io/product/explore/session-replay/web/replay-details/#delete-replays). If you'd like to request bulk deletion, please reach out to your Account Manager or support@sentry.io to request deletion. \n\n### Patches\n\nUpgrade the `sentry-android` SDK to version [8.14.0](https://github.com/getsentry/sentry-java/releases/tag/8.14.0)\n\n### Workarounds\n\nWe recommend upgrading to the latest version of the SDK, but if it is not an option, customers may either:\n- Downgrade their use of Jetpack Compose to <= 1.7.x\n- Drop session sample rates to 0.0 \n```\noptions.sessionReplay.onErrorSampleRate = 0.0\noptions.sessionReplay.sessionSampleRate = 0.0\n```\nPlease see our documentation for more information configuring [Session Replays for Android](https://docs.sentry.io/platforms/android/session-replay/#set-up).\n\n### References\n\nThis issue was identified in Issue https://github.com/getsentry/sentry-java/issues/4467 and fixed in https://github.com/getsentry/sentry-java/pull/4485",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "io.sentry:sentry-android"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "8.14.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "io.sentry:sentry-android-replay"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "8.14.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/getsentry/sentry-java/security/advisories/GHSA-7cjh-xx4r-qh3f"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/getsentry/sentry-java/issues/4467"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/getsentry/sentry-java/pull/4485"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/getsentry/sentry-java/commit/8bfa9cceab402e58f6723a0694158d27e8a41a56"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/getsentry/sentry-java"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/getsentry/sentry-java/releases/tag/8.14.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-532" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-06-20T13:28:26Z",
    "nvd_published_at" : null
  }
}