CVE-2019-3500: High severity Aria2 Project Aria2 vulnerability
Published Jan 2, 2019
·Updated
aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.
Affected Software
9 affected componentsFixes available
Aria2 Project Aria2=1.33.1
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Fedoraproject Fedora=28
Fedoraproject Fedora=29
Fedoraproject Fedora=30
Canonical Ubuntu Linux=18.10
Canonical Ubuntu Linux=19.04
debian/aria2
1.35.0-31.36.0-11.37.0+debian-31.37.0+debian-4
Remediation
Patch Available
Event History
Jan 2, 2019
CVE Published
via MITRE·07:00 AM
Data Sourced
via MITRE·07:00 AM
Description
Feb 23, 2026
Data Sourced
via Ubuntu·03:54 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·03:55 PM
Description
Data Sourced
via Debian·03:55 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2019-3500?
CVE-2019-3500 has a medium severity level due to the potential exposure of sensitive information.
2
How do I fix CVE-2019-3500?
To fix CVE-2019-3500, upgrade aria2 to versions 1.35.0-3, 1.36.0-1, or 1.37.0+debian-3.
3
What type of vulnerability is CVE-2019-3500?
CVE-2019-3500 is an information disclosure vulnerability affecting aria2 when logging credentials.
4
Which versions of aria2 are affected by CVE-2019-3500?
Versions of aria2 prior to 1.35.0 are affected by CVE-2019-3500.
5
Can local users exploit CVE-2019-3500?
Yes, local users can exploit CVE-2019-3500 by accessing logs that may contain HTTP Basic Authentication credentials.