PT-2019-12741 · Buildbot+1 · Buildbot+1

Phillip Kuhrt · Publicado 2019-05-23 · Atualizado 2025-01-05 · CVE-2019-12300

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Buildbot versions prior to 1.8.2 Buildbot versions 2.x prior to 2.3.1

Description The issue allows an attacker to login as a victim if they have a token that permits them to read the victim's user details. This is possible because Buildbot accepts and uses user-submitted authorization tokens from OAuth for authentication.

Recommendations For Buildbot versions prior to 1.8.2, update to version 1.8.2 or later. For Buildbot versions 2.x prior to 2.3.1, update to version 2.3.1 or later.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

ALT-PU-2020-1639

ALT-PU-2024-17789

CVE-2019-12300

GHSA-G86P-HGX5-2PFH

PYSEC-2019-6

Produtos afetados

Alt Linux

Buildbot

Referências · 17

• https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication · Correção
• https://github.com/buildbot/buildbot · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/buildbot/PYSEC-2019-6.yaml · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/7GXKO7OYLKBTXXXKF4VPHWT7GVYWFVYA · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12300 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2019-12300 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-g86p-hgx5-2pfh · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4XLOM2K4M4723BCLHZJEX52KJXZSEVRL · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-12300 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GXKO7OYLKBTXXXKF4VPHWT7GVYWFVYA · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-12300 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLOM2K4M4723BCLHZJEX52KJXZSEVRL · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-6 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-12300 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-12300 · Aviso do Fabricante