CVE-2018-19443

MEDIUM5.9EPSS 0.20%

Session Fixation in Tryton

發布日:2018/11/29修改日:2024/11/13

也稱為:GHSA-32w7-9whp-cjp9PYSEC-2018-77

描述

The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.

受影響套件(2)

PyPI/tryton>= 5.0.0, < 5.0.1
PyPI/tryton>= 5.0.0, < 5.0.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
osv	CVSS 3.1	MEDIUM5.9	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

參考連結(5)

ADVISORYhttps://github.com/advisories/GHSA-32w7-9whp-cjp9
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2018-19443
WEBhttps://bugs.tryton.org/issue7792
WEBhttps://discuss.tryton.org/t/security-release-for-issue7792/830
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/tryton/PYSEC-2018-77.yaml