PT-2019-20160 · Buildbot · Buildbot
Publicado
2019-02-03
·
Atualizado
2019-02-03
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
Name of the Vulnerable Software and Affected Versions
Buildbot versions prior to 1.8.1
Description
The issue affects the Buildbot application, where the
www/resource.py component is vulnerable to CRLF injection. This occurs in the Location header of the "/auth/login" and "/auth/logout" API endpoints via the redirect parameter. The vulnerability can impact other web sites within the same domain.Recommendations
For versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the
/auth/login and /auth/logout API endpoints to minimize the risk of exploitation. Avoid using the redirect parameter in these endpoints until the issue is resolved. Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Buildbot