CVE-2019-15149: Mitogen core.py Unidirectional-Routing Protection Bypass
Summary
CVE-2019-15149: Undirectional routing wasn't respected in some cases in Mitogen. Affects mitogen versions < 0.2.8. Fixed in 0.2.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mitogen is a Python library that provides a mechanism for executing code in a remote Python interpreter. It is commonly used in various automation tools and frameworks, such as Ansible. The library allows for secure communication between the local and remote interpreters by implementing unidirectional routing protection. This protection ensures that messages can only flow from the local to the remote interpreter, preventing potential security risks.
Vulnerability Detail
The vulnerability identified as CVE-2019-15149 in Mitogen versions prior to 0.2.8 is a bypass of the unidirectional-routing protection mechanism. The issue arises due to a typo in the core.py file, which causes the protection mechanism to be dropped when a child process is initiated by another child process. It is important to note that the Ansible extension is not affected by this vulnerability. The vendor disputes the severity of this issue, as it requires specific conditions to be met, including an affected use case within a library caller and a bug in the message receiver policy code. However, if these conditions are met, an attacker could potentially exploit this vulnerability to bypass the unidirectional-routing protection and gain unauthorized access to the remote interpreter.
How To Fix
Minimum fixed version
0.2.8
This is the first release that contains the fix.
pip install --upgrade "mitogen==0.2.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by ensuring that the affected use case within a library caller and the bug in the message receiver policy code are not present in their implementation.
Conclusion
In conclusion, the vulnerability identified as CVE-2019-15149 in Mitogen versions prior to 0.2.8 allows for the bypass of the unidirectional-routing protection mechanism. While the vendor disputes the severity of the issue, it is recommended to upgrade to the fixed version to ensure the proper functioning of the protection mechanism. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mitogen →
FAQ
Mitogen is a Python library that enables code execution in a remote Python interpreter, commonly used in automation tools like Ansible.
Unidirectional-routing protection in Mitogen ensures that messages can only flow from the local to the remote interpreter, enhancing security by preventing unauthorized access.
No, the Ansible extension is not affected by this vulnerability.
If the specific conditions required for exploitation are met, an attacker could bypass the unidirectional-routing protection and gain unauthorized access to the remote interpreter.
To fix this vulnerability, upgrade to Mitogen version 0.2.8 or later by running 'pip install --upgrade mitogen'.
Related vulnerabilities
Recent vulnerabilities recorded for mitogen.
