PT-2019-18674 · Fedora · Pagure

Bowlofeggs · Publicado 2019-02-08 · Atualizado 2024-06-15 · CVE-2019-7628

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pagure version 5.2

Description The issue allows for the leakage of API keys via email, which can be intercepted by man-in-the-middle attackers due to the lack of TLS certificate validation on many email servers. This can lead to unauthorized access to Pagure on behalf of other users. The problem is specifically found in the API token expiration reminder cron job, located in the files/api key expire mail.py file.

Recommendations For Pagure version 5.2, consider disabling the API token expiration reminder cron job as a temporary workaround to prevent API key leakage.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2019-7628

OPENSUSE-SU-2024:11139-1

Produtos afetados

Pagure

Referências · 9

• https://pagure.io/pagure/c/9905fb1e64341822366b6ab1d414d2baa230af0a · Aviso do Fabricante
• https://pagure.io/pagure/issue/4253 · Nota
• https://pagure.io/pagure/issue/4230 · Aviso do Fabricante
• https://pagure.io/pagure/pull-request/4254 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-7628 · Nota
• https://pagure.io/pagure/issue/4252 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-7628 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-7628 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:11139-1 · Aviso do Fabricante