PT-2020-9369 · Cisofy · Lynis

Sander Bos · Published 2020-06-18 · Updated 2024-06-15 · CVE-2019-13033

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: CISOfy Lynis versions 2.x through 2.7.5

Description: The issue allows an attacker to obtain the license key by examining the process list during a data upload. This license key can then be used to upload data to a central Lynis server, potentially allowing the upload of additional scan data. However, it is noted that knowing the license key does not enable data extraction.

Recommendations: For CISOfy Lynis versions 2.x through 2.7.5, consider restricting access to the process list during data uploads to minimize the risk of the license key being obtained. As a temporary workaround, restrict the ability to upload data to the central Lynis server until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-13033

DLA-2253-1

OPENSUSE-SU-2024:11032-1

Affected Products

Lynis

References · 19

• https://osv.dev/vulnerability/DEBIAN-CVE-2019-13033 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11032-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13033 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-13033 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-13033 · Vendor Advisory
• https://cisofy.com/security/cve/cve-2019-13033 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2253-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13033 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-13033 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-13033 · Vendor Advisory
• https://github.com/CISOfy/lynis/commit/3b9eda53cc20e851c4456618f027bc9ea794ad30 · Note
• https://suse.com/security/cve/CVE-2017-8108 · Note
• https://t.me/cvenotify/4482 · Telegram Post