CVE-2019-15149 Undirectional routing wasn't respected in some cases in Mitogen
A typo in Mitogen disables routing protection for child-initiated connections, potentially allowing security bypass if combined with other specific bugs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-15149?
CVE-2019-15149 is a critical vulnerability in n/a, published on 18 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. The Ansible extension is unaffected. NOTE: the vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors, i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led to reliance on this extra protection mechanism
Weakness: CWE-254
Which versions are affected by CVE-2019-15149?
3 open source packages ship an affected version, including mitogen. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mitogen PyPI | All versions | 0.2.8 |
mitogen PyPI | All versions | 0.2.8 |
mitogen PyPI | All versions | 0.2.8 |
Products include Networkgenomics Mitogen.
How do I fix CVE-2019-15149?
Upgrade mitogen to 0.2.8 or later.
Is CVE-2019-15149 being exploited?
There is no known exploitation of CVE-2019-15149 in the wild and no public exploit code.
Sources
Also known as GHSA-8rf6-w2mx-4xjh, PYSEC-2019-104.