CVE-2019-15149: Mitogen Unidirectional-Routing Protection Bypass
Summary
CVE-2019-15149: DISPUTED core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. Affects mitogen across 2 version ranges.
< 0.2.8
< 5924af1566763e48c42028399ea0cd95c457b3dc
Fixed in 5924af1566763e48c42028399ea0cd95c457b3dc. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mitogen is a Python library that provides a mechanism for efficient and secure communication between processes. It is commonly used in various applications, including Ansible. Mitogen allows for the creation of a hierarchy of child processes, with each child having a unidirectional routing protection mechanism to prevent unauthorized communication. However, a typo in the core.py file of Mitogen versions before 0.2.8 inadvertently disables this protection mechanism when a child is initiated by another child. It is important to note that the Ansible extension is not affected by this vulnerability.
Vulnerability Detail
The vulnerability in Mitogen versions before 0.2.8 arises due to a typo in the core.py file. This typo results in the dropping of the unidirectional-routing protection mechanism when a child process is initiated by another child process. While the vendor disputes the severity of this issue, as it requires specific conditions to be met, it is still considered a vulnerability. Exploitation of this vulnerability requires an affected use case within a library caller and a bug in the message receiver policy code that led to reliance on this extra protection mechanism. If these conditions are met, an attacker may be able to bypass the intended security measures and gain unauthorized access or perform unauthorized actions within the affected application.
How To Fix
Minimum fixed version
5924af1566763e48c42028399ea0cd95c457b3dc
This is the first release that contains the fix.
pip install --upgrade "mitogen==5924af1566763e48c42028399ea0cd95c457b3dc"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that their application does not rely on the extra protection mechanism provided by the unidirectional-routing feature in Mitogen versions before 0.2.8. It is important to review the code and configuration of the application to identify any potential reliance on this mechanism and implement alternative security measures if necessary.
Conclusion
In conclusion, Mitogen versions before 0.2.8 are vulnerable to a bypass of the unidirectional-routing protection mechanism. While the vendor disputes the severity of this issue, it is still recommended to update to Mitogen 0.2.8 or later to ensure the proper functioning of the protection mechanism. Users should review their code and configuration to identify any reliance on the affected mechanism and implement alternative security measures if necessary. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for mitogen →
FAQ
No, the Ansible extension is not affected by this vulnerability. Only Mitogen versions before 0.2.8 are vulnerable.
If successfully exploited, this vulnerability could allow an attacker to bypass the intended security measures and gain unauthorized access or perform unauthorized actions within the affected application.
There are no known instances of this vulnerability being exploited in the wild. However, it is still important to apply the necessary updates and security measures to protect against potential exploitation.
No, there is no specific CVSS score available for this vulnerability.
For more information about this vulnerability, you can refer to the Mitogen advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/mitogen/PYSEC-2019-104.yaml
Related vulnerabilities
Recent vulnerabilities recorded for mitogen.
