PT-2019-20160 · Buildbot · Buildbot
Published
2019-02-03
·
Updated
2019-02-03
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Buildbot versions prior to 1.8.1
Description
The issue affects the Buildbot application, where the
www/resource.py component is vulnerable to CRLF injection. This occurs in the Location header of the "/auth/login" and "/auth/logout" API endpoints via the redirect parameter. The vulnerability can impact other web sites within the same domain.Recommendations
For versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the
/auth/login and /auth/logout API endpoints to minimize the risk of exploitation. Avoid using the redirect parameter in these endpoints until the issue is resolved. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Buildbot