CVE-2019-15149: Mitogen core.py Unidirectional-Routing Protection Bypass
Summary
PYSEC-2019-34: DISPUTED core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. Affects mitogen across 2 version ranges.
< 0.2.8
< 5924af1566763e48c42028399ea0cd95c457b3dc
Fixed in 5924af1566763e48c42028399ea0cd95c457b3dc. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mitogen is a Python library that provides a mechanism for executing code in a remote Python interpreter. It allows for efficient and secure communication between the local and remote interpreters. The library is commonly used in various applications and frameworks, such as Ansible. This vulnerability affects versions of Mitogen before 0.2.8.
Vulnerability Detail
The vulnerability in Mitogen's core.py lies in a typo that causes the unidirectional-routing protection mechanism to be bypassed when a child process is initiated by another child process. This protection mechanism is designed to prevent unauthorized communication between the local and remote interpreters. However, due to the typo, this protection can be bypassed in certain scenarios. It is important to note that the Ansible extension is not affected by this vulnerability. The vendor disputes the severity of this issue, as it requires specific conditions to be met, including an affected use case within a library caller and a bug in the message receiver policy code.
How To Fix
Minimum fixed version
5924af1566763e48c42028399ea0cd95c457b3dc
This is the first release that contains the fix.
pip install --upgrade "mitogen==5924af1566763e48c42028399ea0cd95c457b3dc"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability.
Conclusion
The vulnerability in Mitogen's core.py allows for the bypass of the unidirectional-routing protection mechanism, potentially enabling unauthorized communication between local and remote Python interpreters. It is recommended to update Mitogen to version 0.2.8 or later to mitigate this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mitogen →
FAQ
Mitogen is a Python library that facilitates communication between local and remote Python interpreters.
This vulnerability could potentially allow unauthorized communication between the local and remote interpreters, compromising the security of the system.
No, the Ansible extension is not affected by this vulnerability.
To fix this vulnerability, update Mitogen to version 0.2.8 or later using the command: pip install --upgrade mitogen
No, there is no specific workaround provided for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for mitogen.
