[SECURITY] [DLA 1636-1] aria2 security update

Package : aria2 Version : 1.18.8-1+deb8u1 CVE ID : CVE-2019-3500 Debian Bug : 918058 It was discovered that aria2 the lightweight command-line download utility can store passed user credentials in a log file when using the --log option. This might allow local users to obtain sensitive information...

DLA-1636-1 aria2 - security update

Bulletin has no description...

Debian: Security Advisory (DLA-1636-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2019-0036 Updated aria2 package fixes security vulnerability

It was observed that URL's which gets downloaded via "--log=" attribute stores sensitive information. This update fixes that...

openSUSE Security Update : aria2 (openSUSE-2019-50)

This update for aria2 fixes the following security issue : - CVE-2019-3500: Metadata and potential password leaks via --log= boo1120488 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

openSUSE: Security Advisory for aria2 (openSUSE-SU-2019:0050-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for aria2 (moderate)

openSUSE Security Update: Security update for aria2 Announcement ID: openSUSE-SU-2019:0050-1 Rating: moderate References: 1120488 Cross-References: CVE-2019-3500 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 An update that fixes one vulnerability is now...

ALPINE-CVE-2019-3500

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file...

CVE-2019-3500

CVE-2019-3500 affects the download utility aria2 : when using --log, credentials (HTTP Basic username/password) can be written to a local log file, potentially exposing them to local users. The issue is tied to how aria2 handles logging rather than network flow, with vendor advisories and patch l...

aria2 1.33.1 Password Disclosure

Exploit Title: Metadata and potential password leak in aria2 Date: 2019-01-02 Exploit Author: Dhiraj Mishra Software Link: https://github.com/aria2/aria2 Version: aria2 1.33.1 Tested on: Linux 4.15.0-38-generic CVE: CVE-2019-3500 Summary aria2 is a lightweight multi-protocol command-line utility,...

Gentoo Security Advisory GLSA 201101-04 (aria2)

The remote host is missing updates announced in advisory GLSA 201101-04. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 201101-04 (aria2)

The remote host is missing updates announced in advisory GLSA 201101-04. SPDX-FileCopyrightText: 2011 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

GLSA-201101-04 : aria2: Directory traversal

The remote host is affected by the vulnerability described in GLSA-201101-04 aria2: Directory traversal A directory traversal vulnerability was discovered in aria2. Impact : A remote attacker could entice a user to download from a specially crafted metalink file, resulting in the creation of...

aria2: Directory traversal

Background aria2 is a download utility with resuming and segmented downloading with HTTP/HTTPS/FTP/BitTorrent support. Description A directory traversal vulnerability was discovered in aria2. Impact A remote attacker could entice a user to download from a specially crafted metalink file, resultin...

openSUSE Security Update : aria2 (openSUSE-SU-2010:0338-2)

Specially crafted metalink files could trick aria2 into store downloaded files outside of the intended directory CVE-2010-1512. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update aria2-3063. The...

MDVA-2009:174 : aria2

This update fixes an issue with aria2: - the default path aria2c uses to look for certificates for public CAs isn't the right one on mandriva systems %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security fix. Disabled on 2012/09/06. C...

MDVA-2010:077 : aria2

In some cases aria2 would crash with a segmentation fault when encountering file not found errors. This could particularly happen when installing updates with urpmi. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security fix. Disabled ...

Fedora 12 : aria2-1.9.3-1.fc12 (2010-8908)

Thu May 20 2010 Rahul Sundaram - 1.9.3-1 - http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE WS?revision=2101 - Fixes CVE-2010-1512. rhbz 592014 - Sat Mar 20 2010 Rahul Sundaram - 1.9.0-1 - http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE WS?revision=1990 - Tue Feb 16 2010 Rahul...

Fedora 11 : aria2-1.9.3-1.fc11 (2010-8915)

Thu May 20 2010 Rahul Sundaram - 1.9.3-1 - http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE WS?revision=2101 - Fixes CVE-2010-1512. rhbz 592014 - Sat Mar 20 2010 Rahul Sundaram - 1.9.0-1 - http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE WS?revision=1990 - Tue Feb 16 2010 Rahul...

Fedora 13 : aria2-1.9.3-1.fc13 (2010-8905)

Thu May 20 2010 Rahul Sundaram - 1.9.3-1 - http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE WS?revision=2101 - Fixes CVE-2010-1512. rhbz 592014 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted...