PT-2019-14014 · Mitogen · Mitogen

Published 2019-08-18 · Updated 2024-08-05 · CVE-2019-15149

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mitogen versions prior to 0.2.8

Description The issue is related to a typo in core.py that affects the unidirectional-routing protection mechanism when a child is initiated by another child. The Ansible extension is not affected. The vendor disputes this issue, stating it is only exploitable in conjunction with other hypothetical factors, including an affected use case within a library caller and a bug in the message receiver policy code.

Recommendations For versions prior to 0.2.8, update to version 0.2.8 or later to resolve the issue. As a temporary workaround, consider reviewing and adjusting the message receiver policy code to minimize reliance on the extra protection mechanism dropped due to the typo.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2019-15149

GHSA-8RF6-W2MX-4XJH

PYSEC-2019-104

Affected Products

Mitogen

References · 10

• https://github.com/dw/mitogen/commit/5924af1566763e48c42028399ea0cd95c457b3dc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-15149 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15149 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-104 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8rf6-w2mx-4xjh · Vendor Advisory
• https://github.com/dw/mitogen · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/mitogen/PYSEC-2019-104.yaml · Note
• https://github.com/advisories/GHSA-8rf6-w2mx-4xjh · Note
• https://mitogen.networkgenomics.com/changelog.html#v0-2-8-2019-08-18 · Note
• https://t.me/cvenotify/89093 · Telegram Post