CVE-2019-3500

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.

CVSS v3 7.8 HIGH
CVSS v2.0 2.1 LOW

7.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/aria2/aria2/issues/1329	Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/01/msg00012.html	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00039.html	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/532M22TAOOIY3J4XX4R7BLZHXJRUSBQ2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MUUYDELHRLVE2AFNVR3OJ6ILUKVLY4B/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5OLPTVYHJZJ2MVEXJCNPXBSFPVPE4XX/
https://usn.ubuntu.com/3965-1/	Third Party Advisory
https://github.com/aria2/aria2/issues/1329	Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/01/msg00012.html	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00039.html	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/532M22TAOOIY3J4XX4R7BLZHXJRUSBQ2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MUUYDELHRLVE2AFNVR3OJ6ILUKVLY4B/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5OLPTVYHJZJ2MVEXJCNPXBSFPVPE4XX/
https://usn.ubuntu.com/3965-1/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:aria2_project:aria2:1.33.1:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:debian:debian_linux:8.0:::::::*
	cpe:2.3:o:debian:debian_linux:9.0:::::::*

Configuration 3 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:28:::::::*
	cpe:2.3:o:fedoraproject:fedora:29:::::::*
	cpe:2.3:o:fedoraproject:fedora:30:::::::*

Configuration 4 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:18.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:19.04:::::::*

History

21 Nov 2024, 04:42

Type	Values Removed	Values Added
References	~~() https://github.com/aria2/aria2/issues/1329 - Patch, Third Party Advisory~~	() https://github.com/aria2/aria2/issues/1329 - Patch, Third Party Advisory
References	~~() https://lists.debian.org/debian-lts-announce/2019/01/msg00012.html - Mailing List, Third Party Advisory~~	() https://lists.debian.org/debian-lts-announce/2019/01/msg00012.html - Mailing List, Third Party Advisory
References	~~() https://lists.debian.org/debian-lts-announce/2021/12/msg00039.html - Mailing List, Third Party Advisory~~	() https://lists.debian.org/debian-lts-announce/2021/12/msg00039.html - Mailing List, Third Party Advisory
References	~~() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/532M22TAOOIY3J4XX4R7BLZHXJRUSBQ2/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/532M22TAOOIY3J4XX4R7BLZHXJRUSBQ2/ -
References	~~() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MUUYDELHRLVE2AFNVR3OJ6ILUKVLY4B/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MUUYDELHRLVE2AFNVR3OJ6ILUKVLY4B/ -
References	~~() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5OLPTVYHJZJ2MVEXJCNPXBSFPVPE4XX/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5OLPTVYHJZJ2MVEXJCNPXBSFPVPE4XX/ -
References	~~() https://usn.ubuntu.com/3965-1/ - Third Party Advisory~~	() https://usn.ubuntu.com/3965-1/ - Third Party Advisory

07 Nov 2023, 03:09

Type	Values Removed	Values Added
References	{'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/532M22TAOOIY3J4XX4R7BLZHXJRUSBQ2/', 'name': 'FEDORA-2019-8b8c774b84', 'tags': ['Mailing List', 'Release Notes', 'Third Party Advisory'], 'refsource': 'FEDORA'} {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MUUYDELHRLVE2AFNVR3OJ6ILUKVLY4B/', 'name': 'FEDORA-2019-248ad990b4', 'tags': ['Mailing List', 'Release Notes', 'Third Party Advisory'], 'refsource': 'FEDORA'} {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5OLPTVYHJZJ2MVEXJCNPXBSFPVPE4XX/', 'name': 'FEDORA-2019-fa61af95b3', 'tags': ['Mailing List', 'Release Notes', 'Third Party Advisory'], 'refsource': 'FEDORA'}	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MUUYDELHRLVE2AFNVR3OJ6ILUKVLY4B/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5OLPTVYHJZJ2MVEXJCNPXBSFPVPE4XX/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/532M22TAOOIY3J4XX4R7BLZHXJRUSBQ2/ -

Information

Published : 2019-01-02 07:29

Updated : 2024-11-21 04:42

NVD link : CVE-2019-3500

Mitre link : CVE-2019-3500

CVE.ORG link : CVE-2019-3500

JSON object : View

Products Affected

debian

debian_linux

aria2_project

aria2

fedoraproject

fedora

canonical

ubuntu_linux

CWE

CWE-532

Insertion of Sensitive Information into Log File

7.8 /10