CVE-2018-19443 Session Fixation in Tryton
Man-in-the-middle attackers can steal user session tokens because the Tryton client sends them in cleartext during failed bus connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-19443?
CVE-2018-19443 is a medium-severity vulnerability in n/a, published on 22 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.
Weakness: CWE-384
Which versions are affected by CVE-2018-19443?
3 open source packages ship an affected version, including tryton. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tryton PyPI | From 5.0.0 | 5.0.1 |
tryton PyPI | From 5.0.0 | 5.0.1 |
tryton PyPI | From 5.0.0 | 5.0.1 |
Products include Tryton Tryton.
How do I fix CVE-2018-19443?
Upgrade tryton to 5.0.1 or later.
Is CVE-2018-19443 being exploited?
There is no known exploitation of CVE-2018-19443 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2014-6633 Tryton vulnerable to arbitrary command execution
- CVE-2013-4510 Tryton Directory Traversal vulnerability
- CVE-2017-0360 Tryton Information Disclosure Vulnerability
- CVE-2016-1241 Tryton allows users to read the hashed password
- CVE-2016-1242 Tryton allow authenticated users with certain permissions to read arbitrary files via the name parameter
Sources
Also known as GHSA-32w7-9whp-cjp9, PYSEC-2018-77, UBUNTU-CVE-2018-19443.