PT-2019-14014 · Mitogen · Mitogen

CVE-2019-15149 · Publicado 2019-08-18 · Atualizado 2024-08-05

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mitogen versions prior to 0.2.8

Description The issue is related to a typo in core.py that affects the unidirectional-routing protection mechanism when a child is initiated by another child. The Ansible extension is not affected. The vendor disputes this issue, stating it is only exploitable in conjunction with other hypothetical factors, including an affected use case within a library caller and a bug in the message receiver policy code.

Recommendations For versions prior to 0.2.8, update to version 0.2.8 or later to resolve the issue. As a temporary workaround, consider reviewing and adjusting the message receiver policy code to minimize reliance on the extra protection mechanism dropped due to the typo.

Correção

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

CVE-2019-15149

GHSA-8RF6-W2MX-4XJH

PYSEC-2019-104

Produtos afetados

Mitogen

Referências · 10

• https://github.com/dw/mitogen/commit/5924af1566763e48c42028399ea0cd95c457b3dc · Correção
• https://github.com/dw/mitogen · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/mitogen/PYSEC-2019-104.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-15149 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15149 · Aviso do Fabricante
• https://github.com/advisories/GHSA-8rf6-w2mx-4xjh · Nota
• https://mitogen.networkgenomics.com/changelog.html#v0-2-8-2019-08-18 · Nota
• https://t.me/cvenotify/89093 · Publicação no Telegram
• https://osv.dev/vulnerability/PYSEC-2019-104 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8rf6-w2mx-4xjh · Aviso do Fabricante