679482 – net-misc/aria2: password leak for HTTP based authentication (CVE-2019-3500)

Bug 679482 - net-misc/aria2: password leak for HTTP based authentication (CVE-2019-3500)

Summary: net-misc/aria2: password leak for HTTP based authentication (CVE-2019-3500)

Status:	RESOLVED DUPLICATE of bug 674622

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:	B4 [upstream/ebuild cve]
Keywords:

Depends on:
Blocks:

Reported:	2019-03-05 01:09 UTC by GLSAMaker/CVETool Bot
Modified:	2019-04-05 15:45 UTC (History)
CC List:	2 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description GLSAMaker/CVETool Bot gentoo-dev

2019-03-05 01:09:59 UTC

CVE-2019-3500 (https://nvd.nist.gov/vuln/detail/CVE-2019-3500):
  aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic
  Authentication username and password in a file, which might allow local
  users to obtain sensitive information by reading this file.



Upstream issue:

https://github.com/aria2/aria2/issues/1329

Upstream patch:

https://github.com/aria2/aria2/commit/37368130ca7de5491a75fd18a20c5c5cc641824a

References:

https://seclists.org/oss-sec/2019/q1/13

Comment 1 Michał Górny archtester

2019-04-05 15:45:18 UTC


*** This bug has been marked as a duplicate of bug 674622 ***