What is GHSA-mh78-8f49-vjg3?

GHSA-mh78-8f49-vjg3 is a security advisory published by GitHub Security Advisories with High severity. Home Assistant information disclosure vulnerability

Which CVE IDs does GHSA-mh78-8f49-vjg3 cover?

GHSA-mh78-8f49-vjg3 covers the following CVE IDs: CVE-2018-21019. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mh78-8f49-vjg3?

GHSA-mh78-8f49-vjg3 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-mh78-8f49-vjg3?

GHSA-mh78-8f49-vjg3 affects 1 product, including: pip/homeassistant:\u003c 0.67.0.

GHSA-mh78-8f49-vjg3HighCVSS 7.5

Home Assistant information disclosure vulnerability

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

September 20, 2024

🔗 CVE IDs covered (1)

CVE-2018-21019 →

📋 Description

Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py.

🎯 Affected products1

pip/homeassistant:< 0.67.0

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2018-21019
https://github.com/home-assistant/core/pull/13836
https://github.com/home-assistant/core/commit/598f093bf0fecdefaa3d95d1ddae71317a05321e
https://github.com/home-assistant/core/releases/tag/0.67.0
https://github.com/home-assistant/home-assistant/pull/13836
https://github.com/home-assistant/home-assistant/releases/tag/0.67.0
https://github.com/pypa/advisory-database/tree/main/vulns/homeassistant/PYSEC-2019-221.yaml
https://github.com/advisories/GHSA-mh78-8f49-vjg3