PT-2019-20159 · Buildbot · Buildbot

Publicado 2019-05-23 · Atualizado 2019-05-23

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Buildbot versions prior to 1.8.2 Buildbot versions 2.x prior to 2.3.1

Description The issue allows an attacker with a token that permits reading a victim's user details to login as the victim, by submitting this token for authentication.

Recommendations For Buildbot versions prior to 1.8.2, update to version 1.8.2 or later. For Buildbot versions 2.x prior to 2.3.1, update to version 2.3.1 or later.

Identificadores relacionados

PYSEC-2019-76

Produtos afetados

Buildbot

Referências · 4

• https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4XLOM2K4M4723BCLHZJEX52KJXZSEVRL · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-76 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/7GXKO7OYLKBTXXXKF4VPHWT7GVYWFVYA · Aviso do Fabricante