critical9.8
CVE-2019-15149
Undirectional routing wasn't respected in some cases in Mitogen
Impact
core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. The Ansible extension is unaffected. NOTE: the vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors, i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led to reliance on this extra protection mechanism.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | mitogen | < 0.2.8 | 0.2.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Networkgenomics | Mitogen | before 0.2.8 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/dw/mitogen/commit/5924af1566763e48c42028399ea0cd95c457b3dc
- https://mitogen.networkgenomics.com/changelog.html#v0-2-8-2019-08-18
- https://github.com/advisories/GHSA-8rf6-w2mx-4xjh
- https://nvd.nist.gov/vuln/detail/CVE-2019-15149
- https://github.com/pypa/advisory-database/tree/main/vulns/mitogen/PYSEC-2019-104.yaml