CVE-2019-15149

core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. The Ansible extension is unaffected. NOTE: the vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors, i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led to reliance on this extra protection mechanism

• CWE-254

• https://github.com/dw/mitogen/commit/5924af1566763e48c42028399ea0cd95c457b3dcPatch, Third Party Advisory
• https://mitogen.networkgenomics.com/changelog.html#v0-2-8-2019-08-18Release Notes
• https://github.com/dw/mitogen/commit/5924af1566763e48c42028399ea0cd95c457b3dcPatch, Third Party Advisory
• https://mitogen.networkgenomics.com/changelog.html#v0-2-8-2019-08-18Release Notes

Published

Aug 18, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15143In DjVuLibre 3.5.27, the bitmap reader component allows atta…5.5
• CVE-2019-15144In DjVuLibre 3.5.27, the sorting functionality (aka GArrayTe…5.5
• CVE-2019-15145DjVuLibre 3.5.27 allows attackers to cause a denial-of-servi…5.5
• CVE-2019-15146GoPro GPMF-parser 1.2.2 has a heap-based buffer over-read (4…
• CVE-2019-15147GoPro GPMF-parser 1.2.2 has an out-of-bounds read and SEGV i…
• CVE-2019-15148GoPro GPMF-parser 1.2.2 has an out-of-bounds write in OpenMP…
• CVE-2019-1515Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-15150In the OAuth2 Client extension before 0.4 for MediaWiki, a C…8.8
• CVE-2019-15151AdPlug 2.3.1 has a double free in the Cu6mPlayer class in u6…9.8
• CVE-2019-1516Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-15160The SweetXml (aka sweet_xml) package through 0.6.6 for Erlan…
• CVE-2019-15161rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain l…5.3