mitogen-0.2.6.tar.gz: 1 vulnerabilities (highest severity is: 9.8) - autoclosed

[dev-mend-for-github-com[bot]]

Vulnerable Library - mitogen-0.2.6.tar.gz

Library for writing distributed self-replicating programs.

Library home page: https://files.pythonhosted.org/packages/d3/9b/5f44ae787c29f809c7fa5a6369c3795afe3699266c1669da29917bb916ca/mitogen-0.2.6.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Found in HEAD commit: 0814e9322359b62570ae3fd3533ebae14aac7291

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (mitogen version)	Remediation Available
CVE-2019-15149	High	9.8	mitogen-0.2.6.tar.gz	Direct	0.2.8	✅

Details

CVE-2019-15149

### Vulnerable Library - mitogen-0.2.6.tar.gz

Library for writing distributed self-replicating programs.

Library home page: https://files.pythonhosted.org/packages/d3/9b/5f44ae787c29f809c7fa5a6369c3795afe3699266c1669da29917bb916ca/mitogen-0.2.6.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy: - :x: **mitogen-0.2.6.tar.gz** (Vulnerable Library)

Found in HEAD commit: 0814e9322359b62570ae3fd3533ebae14aac7291

Found in base branch: main

### Vulnerability Details

** DISPUTED ** core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. The Ansible extension is unaffected. NOTE: the vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors, i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led to reliance on this extra protection mechanism.

Publish Date: 2019-08-18

URL: CVE-2019-15149

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://mitogen.networkgenomics.com/changelog.html#v0-2-8-2019-08-18

Release Date: 2019-08-18

Fix Resolution: 0.2.8

:rescue_worker_helmet: Automatic Remediation is available for this issue

---

:rescue_worker_helmet: Automatic Remediation is available for this issue.

[dev-mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[dev-mend-for-github-com[bot]]

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

[dev-mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.