CVE-2019-3500 Common Vulnerabilities and Exposures

Upstream information

CVE-2019-3500 at MITRE

Description

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
	National Vulnerability Database
Base Score	2.1
Vector	AV:L/AC:L/Au:N/C:P/I:N/A:N
Access Vector	Local
Access Complexity	Low
Authentication	None
Confidentiality Impact	Partial
Integrity Impact	None
Availability Impact	None

CVSS v3 Scores
	National Vulnerability Database
Base Score	7.8
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector	Local
Attack Complexity	Low
Privileges Required	Low
User Interaction	None
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	High
CVSSv3 Version	3.1

SUSE Bugzilla entry: 1120488 [RESOLVED / FIXED]

SUSE Security Advisories:

openSUSE-SU-2019:0050-1, published Fri Dec 8 15:48:41 2023
openSUSE-SU-2021:1125-1, published Tue Aug 10 09:40:21 2021

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Package Hub 15 SP1	`aria2 >= 1.35.0-bp151.5.3.1` `aria2-devel >= 1.35.0-bp151.5.3.1` `aria2-lang >= 1.35.0-bp151.5.3.1` `libaria2-0 >= 1.35.0-bp151.5.3.1`	Patchnames: openSUSE-2021-1125
SUSE Package Hub 15 SP2	`aria2 >= 1.35.0-bp152.4.3.1` `aria2-devel >= 1.35.0-bp152.4.3.1` `aria2-lang >= 1.35.0-bp152.4.3.1` `libaria2-0 >= 1.35.0-bp152.4.3.1`	Patchnames: openSUSE-2021-1125
SUSE Package Hub 15 SP3	`aria2 >= 1.35.0-bp153.2.3.1` `aria2-devel >= 1.35.0-bp153.2.3.1` `aria2-lang >= 1.35.0-bp153.2.3.1` `libaria2-0 >= 1.35.0-bp153.2.3.1`	Patchnames: openSUSE-2021-1125
SUSE Package Hub 15	`aria2 >= 1.33.1-bp150.3.7.1` `aria2-devel >= 1.33.1-bp150.3.7.1` `aria2-lang >= 1.33.1-bp150.3.7.1` `libaria2-0 >= 1.33.1-bp150.3.7.1`	Patchnames: openSUSE-2019-50
openSUSE Leap 15.0	`aria2 >= 1.33.1-lp150.5.1` `aria2-devel >= 1.33.1-lp150.5.1` `aria2-lang >= 1.33.1-lp150.5.1` `libaria2-0 >= 1.33.1-lp150.5.1`	Patchnames: openSUSE-2019-50
openSUSE Leap 15.2	`aria2 >= 1.35.0-lp152.5.3.1` `aria2-devel >= 1.35.0-lp152.5.3.1` `aria2-lang >= 1.35.0-lp152.5.3.1` `libaria2-0 >= 1.35.0-lp152.5.3.1`	Patchnames: openSUSE-2021-1125
openSUSE Leap 15.3	`aria2 >= 1.35.0-bp153.2.3.1` `aria2-devel >= 1.35.0-bp153.2.3.1` `aria2-lang >= 1.35.0-bp153.2.3.1` `libaria2-0 >= 1.35.0-bp153.2.3.1`	Patchnames: openSUSE-2021-1125
openSUSE Tumbleweed	`aria2 >= 1.36.0-1.2` `aria2-devel >= 1.36.0-1.2` `aria2-lang >= 1.36.0-1.2` `libaria2-0 >= 1.36.0-1.2`	Patchnames: openSUSE Tumbleweed GA aria2-1.36.0-1.2

SUSE Timeline for this CVE

CVE page created: Thu Jan 3 10:59:52 2019
CVE page last modified: Fri Dec 8 17:19:44 2023