CVE-2019-3996: High severity elog vulnerability
ELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when unauthenticated remote attackers send crafted HTTP POST requests.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-3996?
The severity of CVE-2019-3996 is high with a CVSS score of 6.5.
Which software versions are affected by CVE-2019-3996?
ELOG 3.1.4-57bea22 and below, Fedora 30, and Fedora 31 are affected by CVE-2019-3996.
How can unauthenticated remote attackers exploit CVE-2019-3996?
Unauthenticated remote attackers can exploit CVE-2019-3996 by sending crafted HTTP POST requests to use ELOG as an HTTP GET request proxy.
Are there any fixes available for CVE-2019-3996?
Yes, it is recommended to update ELOG to a version higher than 3.1.4-57bea22 to mitigate CVE-2019-3996.
Where can I find more information about CVE-2019-3996?
You can find more information about CVE-2019-3996 at the following references: [Link 1](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IN3FP6VXYSD4OMUCFZNOL7MKPWRQFAL/), [Link 2](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4IAS4HI24H2ERKBZTDEVJ3LEQEFWYSCT/), [Link 3](https://www.tenable.com/security/research/tra-2019-53).