CVE-2018-21019 Home Assistant information disclosure vulnerability
Unauthenticated attackers can read application error logs in Home Assistant, potentially exposing sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-21019?
CVE-2018-21019 is a high-severity vulnerability in n/a, published on 23 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py.
Weakness: CWE-200
Which versions are affected by CVE-2018-21019?
3 open source packages ship an affected version, including homeassistant. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
homeassistant PyPI | All versions | 0.67.0 |
homeassistant PyPI | All versions | 0.67.0 |
homeassistant PyPI | All versions | 0.67.0 |
Products include Home-Assistant Home-Assistant.
How do I fix CVE-2018-21019?
Upgrade homeassistant to 0.67.0 or later.
Is CVE-2018-21019 being exploited?
There is no known exploitation of CVE-2018-21019 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-27482 Auth bypass in core
- CVE-2023-41895 Cross-site Scripting via auth_callback login in Home Assistant Core
- CVE-2023-41897 Lack of XFO header allows clickjacking in Home Assistant Core
- CVE-2026-54317 Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
- CVE-2020-36517 Information disclosure in n/a
Sources
Also known as GHSA-mh78-8f49-vjg3, PYSEC-2019-221.