CVE-2019-15149

Description

** DISPUTED ** core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. The Ansible extension is unaffected. NOTE: the vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors, i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led to reliance on this extra protection mechanism.

How to fix CVE-2019-15149

To remediate CVE-2019-15149, upgrade the affected package to a fixed version below.

• —upgrade to 0.2.8 or later
• —upgrade to 5924af1566763e48c42028399ea0cd95c457b3dc or later

Is CVE-2019-15149 being exploited?

Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 0.2.8
• from 0, < 5924af1566763e48c42028399ea0cd95c457b3dc | from 0, < 0.2.8

CVSS scores

References (6)

• ADVISORYgithub.com/advisories/GHSA-8rf6-w2mx-4xjh
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2019-15149
• PATCHgithub.com/dw/mitogen
• WEBgithub.com/dw/mitogen/commit/5924af1566763e48c42028399ea0cd95c457b3dc