CVE-2019-12300
Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted au ...
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Ubuntu (media).
Descripción
Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details of a victim, they can login as the victim.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| pip::GitHub Security Advisory pip | buildbot | 1.8.2, 2.3.1 |
| debian 11 | buildbot | 2.0.1-2 |
| debian 12 | buildbot | 2.0.1-2 |
| debian 13 | buildbot | 2.0.1-2 |
| debian 14 | buildbot | 2.0.1-2 |
| echo | buildbot | 2.0.1-2 |
| ubuntu 18.04-ESM | buildbot | sin corrección indicada |
| ubuntu 19.10 | buildbot | 2.3.1-1 |
| ubuntu 20.04 | buildbot | 2.3.1-1 |
| ubuntu 20.04-ESM | buildbot | 2.3.1-1 |
| ubuntu 20.10 | buildbot | 2.3.1-1 |
| ubuntu 21.04 | buildbot | 2.3.1-1 |
Mostrar las 23 entradas de 23 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| pip::GitHub Security Advisory pip | buildbot | 1.8.2, 2.3.1 |
| debian 11 | buildbot | 2.0.1-2 |
| debian 12 | buildbot | 2.0.1-2 |
| debian 13 | buildbot | 2.0.1-2 |
| debian 14 | buildbot | 2.0.1-2 |
| echo | buildbot | 2.0.1-2 |
| ubuntu 18.04-ESM | buildbot | sin corrección indicada |
| ubuntu 19.10 | buildbot | 2.3.1-1 |
| ubuntu 20.04 | buildbot | 2.3.1-1 |
| ubuntu 20.04-ESM | buildbot | 2.3.1-1 |
| ubuntu 20.10 | buildbot | 2.3.1-1 |
| ubuntu 21.04 | buildbot | 2.3.1-1 |
| ubuntu 21.10 | buildbot | 2.3.1-1 |
| ubuntu 22.04 | buildbot | 2.3.1-1 |
| ubuntu 22.10 | buildbot | 2.3.1-1 |
| ubuntu 23.04 | buildbot | 2.3.1-1 |
| ubuntu 23.10 | buildbot | 2.3.1-1 |
| ubuntu 24.04 | buildbot | 2.3.1-1 |
| ubuntu 24.10 | buildbot | 2.3.1-1 |
| ubuntu 25.04 | buildbot | 2.3.1-1 |
| ubuntu 25.10 | buildbot | 2.3.1-1 |
| ubuntu 26.04 | buildbot | 2.3.1-1 |
| ubuntu 26.10 | buildbot | 2.3.1-1 |
Referencias
- https://github.com/advisories/GHSA-g86p-hgx5-2pfh
- https://github.com/buildbot/buildbot
- https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication
- https://github.com/pypa/advisory-database/tree/main/vulns/buildbot/PYSEC-2019-6.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4XLOM2K4M4723BCLHZJEX52KJXZSEVRL
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4XLOM2K4M4723BCLHZJEX52KJXZSEVRL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7GXKO7OYLKBTXXXKF4VPHWT7GVYWFVYA
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7GXKO7OYLKBTXXXKF4VPHWT7GVYWFVYA/