PT-2019-18674 · Fedora · Pagure

Bowlofeggs · Published 2019-02-08 · Updated 2024-06-15 · CVE-2019-7628

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pagure version 5.2

Description The issue allows for the leakage of API keys via email, which can be intercepted by man-in-the-middle attackers due to the lack of TLS certificate validation on many email servers. This can lead to unauthorized access to Pagure on behalf of other users. The problem is specifically found in the API token expiration reminder cron job, located in the files/api key expire mail.py file.

Recommendations For Pagure version 5.2, consider disabling the API token expiration reminder cron job as a temporary workaround to prevent API key leakage.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-7628

OPENSUSE-SU-2024:11139-1

Affected Products

Pagure

References · 9

• https://pagure.io/pagure/c/9905fb1e64341822366b6ab1d414d2baa230af0a · Vendor Advisory
• https://pagure.io/pagure/issue/4230 · Vendor Advisory
• https://pagure.io/pagure/pull-request/4254 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7628 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7628 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11139-1 · Vendor Advisory
• https://pagure.io/pagure/issue/4253 · Note
• https://suse.com/security/cve/CVE-2019-7628 · Note
• https://pagure.io/pagure/issue/4252 · Note