CVE-2019-3500

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/aria2/aria2/issues/1329Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/01/msg00012.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00039.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/532M22TAOOIY3J4XX4R7BLZHXJRUSBQ2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MUUYDELHRLVE2AFNVR3OJ6ILUKVLY4B/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5OLPTVYHJZJ2MVEXJCNPXBSFPVPE4XX/
https://usn.ubuntu.com/3965-1/Third Party Advisory
https://github.com/aria2/aria2/issues/1329Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/01/msg00012.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00039.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/532M22TAOOIY3J4XX4R7BLZHXJRUSBQ2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MUUYDELHRLVE2AFNVR3OJ6ILUKVLY4B/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5OLPTVYHJZJ2MVEXJCNPXBSFPVPE4XX/
https://usn.ubuntu.com/3965-1/Third Party Advisory

Timeline

Published: Jan 2, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-35014.8The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profi CVE-2019-35527.5C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, mal CVE-2019-35537.5C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, mali CVE-2019-35545.9Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attac CVE-2019-35568.1HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, CVE-2019-35579.8The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This beh CVE-2019-35587.5Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious cli CVE-2019-35597.5Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clien CVE-2019-35607.5An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denial-of-service based on CVE-2019-35619.8Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects all supported version CVE-2019-35626.1A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code CVE-2019-35639.8Wangle's LineBasedFrameDecoder contains logic for identifying newlines which incorrectly advances a buffer, leading to a potential underflow