CVE-2019-15149
📋 TL;DR
CVE-2019-15149 is a typo in Mitogen's core.py that disables unidirectional-routing protection for child processes initiated by other children, potentially allowing unauthorized message routing. This affects Mitogen library users (excluding Ansible extension) who rely on this protection mechanism. The vendor disputes exploitability, noting it requires additional hypothetical bugs.
💻 Affected Systems
- Mitogen
📦 What is this software?
Mitogen by Networkgenomics
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized process communication leading to privilege escalation, data exfiltration, or remote code execution in multi-process architectures.
Likely Case
Limited impact due to requirement of additional bugs in message receiver policy; most configurations remain unaffected.
If Mitigated
No impact if proper message validation and process isolation are implemented independently of this protection.
🎯 Exploit Status
Vendor disputes practical exploitability without additional bugs. No known exploits in wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.2.8
Vendor Advisory: https://mitogen.networkgenomics.com/changelog.html#v0-2-8-2019-08-18
Restart Required: Yes
Instructions:
1. Update Mitogen to version 0.2.8 or later using pip: pip install mitogen>=0.2.8
2. Restart any services using Mitogen
3. Verify the fix by checking version
🔧 Temporary Workarounds
Disable child-to-child process creation
allConfigure applications to avoid creating child processes from other children where possible
# Application-specific configuration required
🧯 If You Can't Patch
- Implement strict message validation and authentication in all process communication
- Isolate processes using containerization or virtualization to limit potential impact
🔍 How to Verify
Check if Vulnerable:
Check Mitogen version: python -c "import mitogen; print(mitogen.__version__)" - if version < 0.2.8, vulnerableCheck Version:
python -c "import mitogen; print(mitogen.__version__)"Verify Fix Applied:
After update, verify version is 0.2.8 or higher using same command📡 Detection & Monitoring
Log Indicators:
- Unexpected process communication patterns
- Unauthorized message routing attempts
Network Indicators:
- Unusual inter-process communication on localhost
SIEM Query:
Process monitoring for unexpected parent-child relationships in Mitogen-based applications