CVE-2019-7628: Infoleak
Pagure 5.2 leaks API keys by e-mailing them to users. Few e-mail servers validate TLS certificates, so it is easy for man-in-the-middle attackers to read these e-mails and gain access to Pagure on behalf of other users. This issue is found in the API token expiration reminder cron job in files/apikeyexpiremail.py; disabling that job is also a viable solution. (E-mailing a substring of the API key was an attempted, but rejected, solution.)
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-7628?
CVE-2019-7628 is a vulnerability found in Pagure 5.2 that leaks API keys by e-mailing them to users, which can be intercepted by attackers.
What is the severity of CVE-2019-7628?
The severity of CVE-2019-7628 is medium with a CVSS score of 5.9.
How does CVE-2019-7628 work?
CVE-2019-7628 works by leaking API keys through emails sent to users, which can be intercepted by attackers performing man-in-the-middle attacks.
Which version of Pagure is affected by CVE-2019-7628?
Pagure version 5.2 is affected by CVE-2019-7628.
Are there any fixes or patches available for CVE-2019-7628?
Yes, fixes and patches for CVE-2019-7628 are available. It is recommended to update to the latest version of Pagure to address this vulnerability.