PT-2018-12554 · Mitmproxy+1 · Mitmproxy+2

Mhils · Published 2018-07-22 · Updated 2018-09-18 · CVE-2018-14505

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions mitmproxy versions prior to 4.0.4

Description The issue allows DNS Rebinding attacks, related to tools/web/app.py. This affects mitmweb in mitmproxy.

Recommendations For versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-14505

GHSA-6M53-C78Q-7QMG

OPENSUSE-SU-2018_2291-1

PYSEC-2018-56

Affected Products

Suse

Mitmproxy

Mitmweb

References · 15

• 🔥 https://github.com/mitmproxy/mitmproxy/issues/3234 · Exploit
• https://osv.dev/vulnerability/PYSEC-2018-56 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-14505 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14505 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-14505 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14505 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-14505 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-14505 · Security Note
• https://ubuntu.com/security/CVE-2018-14505 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6m53-c78q-7qmg · Vendor Advisory
• https://github.com/mitmproxy/mitmproxy · Note
• https://github.com/mitmproxy/mitmproxy/pull/3243 · Note
• https://github.com/mitmproxy/mitmproxy/commit/7f464b89296881f4d9ec032378c4418e832d17e3 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/mitmproxy/PYSEC-2018-56.yaml · Note
• https://github.com/advisories/GHSA-6m53-c78q-7qmg · Note