PT-2018-4797 · Unknown · Pennyworth
Published
2018-06-01
·
Updated
2019-10-09
·
CVE-2016-10619
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
pennyworth (affected versions not specified)
Description
The issue concerns pennyworth, a natural language templating engine, which downloads data resources over HTTP. This makes it susceptible to Man-in-the-Middle (MITM) attacks, where an attacker with a privileged network position can modify or read resources at will. The impact can range from reading sensitive information to remote code execution, depending on the package's behavior.
Recommendations
To mitigate the issue, consider avoiding the use of this package and opt for a different package if available.
As an alternative, reduce the risk of exploitation by ensuring the package is not installed while connected to a public network.
If the package is installed on a private network, minimize the risk by restricting access to trusted individuals, as only those who have compromised the network or have privileged access to the ISP can exploit this vulnerability.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Missing Encryption of Sensitive Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pennyworth