CVE-2019-3500
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2019-3500
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3500.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2019-3500
- Related
- Published
- 2019-01-02T07:29:00Z
- Modified
- 2024-08-01T09:03:04.697740Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.
- References
-
- https://lists.debian.org/debian-lts-announce/2019/01/msg00012.html
- https://lists.debian.org/debian-lts-announce/2021/12/msg00039.html
- https://github.com/aria2/aria2/issues/1329
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/532M22TAOOIY3J4XX4R7BLZHXJRUSBQ2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MUUYDELHRLVE2AFNVR3OJ6ILUKVLY4B/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5OLPTVYHJZJ2MVEXJCNPXBSFPVPE4XX/
- https://usn.ubuntu.com/3965-1/
- https://security.alpinelinux.org/vuln/CVE-2019-3500
- https://security-tracker.debian.org/tracker/CVE-2019-3500
Affected packages
Alpine:v3.7 / aria2
Package
- Name
- aria2
- Purl
- pkg:apk/alpine/aria2?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.33.1-r1
Affected versions
1.*
1.14.1-r0
1.14.1-r1
1.14.2-r0
1.14.2-r1
1.15.0-r0
1.15.1-r0
1.15.1-r1
1.15.2-r0
1.16.0-r0
1.16.1-r0
1.16.2-r0
1.16.3-r0
1.16.4-r0
1.16.5-r0
1.17.0-r0
1.17.1-r0
1.18.0-r0
1.18.1-r0
1.18.1-r1
1.18.3-r0
1.18.4-r0
1.18.5-r0
1.18.6-r0
1.18.7-r0
1.18.8-r0
1.18.9-r0
1.18.10-r0
1.18.10-r1
1.19.0-r0
1.19.2-r0
1.19.3-r0
1.20.0-r0
1.21.0-r0
1.22.0-r0
1.23.0-r0
1.24.0-r0
1.25.0-r0
1.26.0-r0
1.26.1-r0
1.31.0-r0
1.32.0-r0
1.32.0-r1
1.33.0-r0
1.33.1-r0
Debian:11 / aria2
Package
- Name
- aria2
- Purl
- pkg:deb/debian/aria2?arch=source
Debian:12 / aria2
Package
- Name
- aria2
- Purl
- pkg:deb/debian/aria2?arch=source
Debian:13 / aria2
Package
- Name
- aria2
- Purl
- pkg:deb/debian/aria2?arch=source
Git / github.com/aria2/aria2
Affected ranges
- Type
- GIT
- Repo
- https://github.com/aria2/aria2
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected
Affected versions
release-1.*
release-1.10.7
release-1.10.8
release-1.10.9
release-1.11.0
release-1.11.1
release-1.11.2
release-1.12.0
release-1.12.1
release-1.13.0
release-1.14.0
release-1.14.1
release-1.14.2
release-1.15.0
release-1.15.1
release-1.15.2
release-1.16.0
release-1.16.1
release-1.16.2
release-1.16.3
release-1.16.4
release-1.16.5
release-1.17.0
release-1.17.1
release-1.18.0
release-1.18.1
release-1.18.10
release-1.18.2
release-1.18.3
release-1.18.4
release-1.18.5
release-1.18.6
release-1.18.7
release-1.18.8
release-1.18.9
release-1.19.0
release-1.19.1
release-1.19.2
release-1.19.3
release-1.20.0
release-1.21.0
release-1.22.0
release-1.23.0
release-1.24.0
release-1.25.0
release-1.26.0
release-1.27.0
release-1.27.1
release-1.28.0
release-1.29.0
release-1.30.0
release-1.31.0
release-1.32.0
release-1.33.0
release-1.33.1