---
title: Security Bulletin NR18-01
source: https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr18-01
---

## Summary

A security update for the Python agent to prevent a developer from accidentally capturing custom API parameters in High-security mode.

**Release date:** Jan 9, 2018

**Vulnerability identifier:** NR18-01

**Priority:** Medium

## Affected software [#affected]

The following New Relic agent versions are affected:

| **Name**     | **Affected version** | **Notes**          | **Remediated version**                                                                              |
| ------------ | -------------------- | ------------------ | --------------------------------------------------------------------------------------------------- |
| Python agent |                      | High-security mode | [2.100.0.84](https://docs.newrelic.com/docs/release-notes/agent-release-notes/python-release-notes) |

## Vulnerability information [#vuln-info]

An internal audit of the [Python High-security mode](https://docs.newrelic.com/docs/agents/python-agent/configuration/python-agent-configuration#high_security) revealed that the agent could send additional data to New Relic by customizing message params with the tracing APIs. Custom parameters may be sent to New Relic if a developer is passing additional parameters using either the function trace API or the message trace API. These should be disabled when High-security mode is enabled.

### Mitigating factors [#factors]

-   This only affects customers that have enabled High-security mode with the Python agent and a developer is adding additional information to the tracing API.

## Workarounds

If you are unable to upgrade the agent, you may be able to take the following action to ensure you do not send any additional data in High-security mode.

-   Remove any custom params to the [function trace API](https://docs.newrelic.com/docs/agents/python-agent/python-agent-api/function_trace) or the [message trace API](https://docs.newrelic.com/docs/agents/python-agent/python-agent-api/message-trace).

## Report security vulnerabilities to New Relic [#report]

New Relic is committed to the security of our customers and their data. If you believe you have found a security vulnerability in one of our products or websites, we welcome and greatly appreciate you reporting it to New Relic's coordinated disclosure program. For more information, see [Reporting security vulnerabilities](https://docs.newrelic.com/docs/security/new-relic-security/data-privacy/reporting-security-vulnerabilities).

## For more help [#more_help]

Additional documentation resources include:.

-   [Upgrade the Python agent](https://docs.newrelic.com/docs/agents/python-agent/installation-configuration/upgrade-python-agent)
-   [New Relic Security](https://newrelic.com/security)