core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. The Ansible extension is unaffected. NOTE: the vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors, i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led to reliance on this extra protection mechanism

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in
    the case of a child that is initiated by another child. The Ansible extension is unaffected. NOTE: the
    vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors,
    i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led
    to reliance on this extra protection mechanism (CVE-2019-15149)

Latest upstream 0.2.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
423546	SCA: security update for mitogen (GHSA-8rf6-w2mx-4xjh)	Tenable Cloud Security	SCA Checks	critical
423546	SCA: security update for mitogen (GHSA-8rf6-w2mx-4xjh)	Tenable Self-Hosted Container Security	SCA Checks	critical
128486	Fedora 30 : python-mitogen (2019-b25dd670a4)	Nessus	Fedora Local Security Checks	critical
128480	Fedora 29 : python-mitogen (2019-1f17485159)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2019-15149

critical

Tenable Plugins

critical

critical

critical

critical