Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-15149

CVE-2019-15149: Undirectional routing wasn't respected in some cases in Mitogen

9.8

CVSS Score
3.0

Basic Information

CVE ID
CVE-2019-15149
GHSA ID
GHSA-8rf6-w2mx-4xjh
EPSS Score
0.61972%
CWE
-
Published
8/19/2019
Updated
9/25/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
mitogenpip< 0.2.80.2.8

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The commit diff shows a critical typo fix in mitogen/core.py where 'undirectional' was corrected to 'unidirectional' in the _setup_master method. This method initializes the router's configuration, and the typo prevented the unidirectional routing flag from being properly enforced. The vulnerability description explicitly states this typo caused the protection mechanism to fail when children initiated other children. The tests added in router_test.py further validate that sibling contexts should not communicate under unidirectional mode, confirming the security impact of this function's behavior.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*or*.py in Mito**n ***or* *.*.* **s * typo t**t *rops t** uni*ir**tion*l-routin* prot**tion m****nism in t** **s* o* * **il* t**t is initi*t** *y *not**r **il*. T** *nsi*l* *xt*nsion is un*****t**. NOT*: t** v*n*or *isput*s t*is issu* ****us* it is *

Reasoning

T** *ommit *i** s*ows * *riti**l typo *ix in mito**n/*or*.py w**r* 'un*ir**tion*l' w*s *orr**t** to 'uni*ir**tion*l' in t** _s*tup_m*st*r m*t*o*. T*is m*t*o* initi*liz*s t** rout*r's *on*i*ur*tion, *n* t** typo pr*v*nt** t** uni*ir**tion*l routin* *l