~ / search / GHSA-8rf6-w2mx-4xjh

GHSA-8rf6-w2mx-4xjh

Withdrawn on 2019-08-20. GitHub withdrew this advisory; it no longer applies.

Undirectional routing wasn't respected in some cases in Mitogen

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-15149

Packages

EcosystemPackageAffectedFixed in
PyPI mitogen < 0.2.8 0.2.8

Details

As written in the advisory (Markdown source, shown as plain text).

core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. The Ansible extension is unaffected. NOTE: the vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors, i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led to reliance on this extra protection mechanism.

References

External links from the advisory. They lead to third-party sites.