CVE-2019-12300

Advisory

Buildbot 1.8.2 and 2.3.1 fix a vulnerability in OAuth where a user-submitted authorization token was used for authentication. See: <https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication>.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Bug fixes
---------

- Fix vulnerability in OAuth where user-submitted authorization token was used for authentication
(https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication). Thanks to Phillip Kuhrt for reporting it.

Resources

• https://pypi.org/project/buildbot
• https://pyup.io/changelogs/buildbot/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12300
• https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication
• https://lists.fedoraproject.org/archives/list/[email protected]/message/4XLOM2K4M4723BCLHZJEX52KJXZSEVRL/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/7GXKO7OYLKBTXXXKF4VPHWT7GVYWFVYA/