PT-2023-10126 · Unknown · Pylons Horus

Published 2023-01-07 · Updated 2024-05-17 · CVE-2014-125056

Positive Technologies (AI Summary)

CVSS v2.0

1.4

Low

Base vector

AV:A/AC:H/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pylons horus (affected versions not specified)

Description A vulnerability was found in Pylons horus, classified as problematic, affecting some unknown functionality of the file horus/flows/local/services.py. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high, and the exploitation is known to be difficult.

Recommendations To fix this issue, it is recommended to apply a patch, specifically the one identified as fd56ccb62ce3cbdab0484fe4f9c25c4eda6c57ec. As a temporary workaround, consider restricting access to the affected functionality in the horus/flows/local/services.py file until the patch is applied.

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2014-125056

Affected Products

Pylons Horus

References · 6

• https://github.com/Pylons/horus/commit/fd56ccb62ce3cbdab0484fe4f9c25c4eda6c57ec · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-125056 · Security Note
• https://vuldb.com/?id.217598 · Note
• https://t.me/cvenotify/41479 · Telegram Post
• https://vuldb.com/?ctiid.217598 · Note
• https://t.me/cibsecurity/56115 · Telegram Post