PT-2019-18523 · Buildbot+1 · Buildbot+1

Mik317 · Publicado 2019-02-03 · Atualizado 2022-05-14 · CVE-2019-7313

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Buildbot versions prior to 1.8.1

Description The issue allows CRLF injection in the Location header of "/auth/login" and "/auth/logout" API endpoints via the redirect parameter. This affects other web sites in the same domain.

Recommendations For versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /auth/login and /auth/logout API endpoints to minimize the risk of exploitation. Avoid using the redirect parameter in these endpoints until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-93

Identificadores relacionados

ALT-PU-2019-1444

CVE-2019-7313

GHSA-66X7-2R56-FJ77

PYSEC-2019-7

Produtos afetados

Alt Linux

Buildbot

Referências · 15

• 🔥 https://github.com/buildbot/buildbot/wiki/CRLF-injection-in-Buildbot-login-and-logout-redirect-code · Exploit
• https://github.com/buildbot/buildbot/pull/4584/files#diff-a2e7e3ee5f6a1d3cd9c6abf0328c21e0 · Nota
• https://github.com/buildbot/buildbot/commit/e781f110933e05ecdb30abc64327a2c7c9ff9c5a · Nota
• https://github.com/buildbot/buildbot · Nota
• https://github.com/buildbot/buildbot/pull/4584 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/buildbot/PYSEC-2019-7.yaml · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-7313 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-7313 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-7313 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2019-7313 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-7313 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-7313 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-7313 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-7 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-66x7-2r56-fj77 · Aviso do Fabricante