Every CVE Search/ Get API key

CVE-2019-3500

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and...

7.8 HighFix available

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.35%Down 0.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.

Record
CVE-2019-3500
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
CVE List No score

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.

Record
CVE-2019-3500
Updated
2026-11-02
EUVDEUVD-2019-13137 No score

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.

Record
EUVD-2019-13137
Updated
2026-11-03
GitHub AdvisoriesGHSA-g768-79g3-c28j 7.8

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and...

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.

Record
GHSA-g768-79g3-c28j
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-532
Updated
2026-11-02
OSVALPINE-CVE-2019-3500 7.8

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.

Record
ALPINE-CVE-2019-3500
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.8

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.

Record
CVE-2019-3500
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2019-3500 7.8

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.

Record
DEBIAN-CVE-2019-3500
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-3500 7.8

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.

Record
UBUNTU-CVE-2019-3500
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2019-0036 No score

Updated aria2 package fixes security vulnerability

It was observed that URL's which gets downloaded via "--log=" attribute stores sensitive information. This update fixes that.

Record
MGASA-2019-0036
Updated
2026-11-02
OSVopenSUSE-SU-2019:0050-1 No score

Security update for aria2

This update for aria2 fixes the following security issue:

  • CVE-2019-3500: Metadata and potential password leaks via --log= (boo#1120488)
Record
openSUSE-SU-2019:0050-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:1125-1 No score

Security update for aria2

This update for aria2 fixes the following issues:

Update to version 1.35.0:

  • Drop SSLv3.0 and TLSv1.0 and add TLSv1.3
  • TLSv1.3 support is added for GNUTLS and OpenSSL.
  • Platform: Fix compilation without deprecated OpenSSL APIs
  • Remove linux getrandom and use C++ stdlib instead
  • Don't send Accept Metalink header if Metalink is disabled
  • Move bash completion to better location

Update to version 1.34.0:

  • UnknownLengthPieceStorage: return piece length show something in console status when downloading items with unknown content length
  • Fix bug that signal handler does not work with libaria2 when aria2::RUN_ONCE is passed to aria2::run().
  • Retry on HTTP 502
Record
openSUSE-SU-2021:1125-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10631-1 No score

aria2-1.36.0-1.2 on GA media

These are all security issues fixed in the aria2-1.36.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10631-1
Updated
2026-11-02
OSVUSN-4869-1 No score

aria2 vulnerability

It was discovered that aria2 could accidentally leak authentication data. An attacker could possibly use this to gain access to sensitive information.

Record
USN-4869-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
aria2
Alpine:v3.7
 before 1.33.1-r1
1.33.1-r1
aria2
Debian:12
 before 1.34.0-4
1.34.0-4
aria2
Debian:13
 before 1.34.0-4, plus listed versions
0.10.1-10.10.2+1-10.11.0-10.11.2-10.11.3-1
Show 45 moreShow less
0.12.0-10.12.1-10.13.1+1-10.14.0-10.14.0-1+lenny10.14.0-1+lenny20.7.3-10.8.0-10.8.1-10.9.0-11.0.1-11.1.2-11.10.0-11.10.0-21.10.6-11.10.9-11.11.1-11.11.2-11.12.0-11.12.1-11.12.1-21.13.0-11.14.0-11.14.1-11.14.2-11.14.2-21.15.0-11.15.0-21.15.1-11.15.2-11.16.0-11.16.1-11.17.0-11.18.0-11.18.0-21.18.1-11.18.10-11.18.10-21.18.3-11.18.5-11.18.7-11.18.8-11.19.0-11.2.0-11.21.0-1
1.34.0-4
aria2
Debian:14
 before 1.34.0-4, plus listed versions
0.10.1-10.10.2+1-10.11.0-10.11.2-10.11.3-1
Show 45 moreShow less
0.12.0-10.12.1-10.13.1+1-10.14.0-10.14.0-1+lenny10.14.0-1+lenny20.7.3-10.8.0-10.8.1-10.9.0-11.0.1-11.1.2-11.10.0-11.10.0-21.10.6-11.10.9-11.11.1-11.11.2-11.12.0-11.12.1-11.12.1-21.13.0-11.14.0-11.14.1-11.14.2-11.14.2-21.15.0-11.15.0-21.15.1-11.15.2-11.16.0-11.16.1-11.17.0-11.18.0-11.18.0-21.18.1-11.18.10-11.18.10-21.18.3-11.18.5-11.18.7-11.18.8-11.19.0-11.2.0-11.21.0-1
1.34.0-4
aria2
Debian:8
 before 1.18.8-1+deb8u1, plus listed versions
1.18.8-1
1.18.8-1+deb8u1
aria2
Debian:9
 before 1.30.0-2+deb9u1, plus listed versions
1.30.0-2
1.30.0-2+deb9u1
aria2
Mageia:6
 before 1.25.0-1.1.mga6
1.25.0-1.1.mga6
aria2
Ubuntu:Pro:14.04:LTS
 before 1.18.1-1ubuntu0.1~esm1, plus listed versions
1.17.0-11.18.0-11.18.0-1ubuntu21.18.0-21.18.1-1
1.18.1-1ubuntu0.1~esm1
aria2
Ubuntu:Pro:16.04:LTS
 before 1.19.0-1ubuntu0.1~esm1, plus listed versions
1.19.0-11.19.0-1build1
1.19.0-1ubuntu0.1~esm1
aria2
Ubuntu:Pro:18.04:LTS
 before 1.33.1-1ubuntu0.1~esm1, plus listed versions
1.32.0-11.32.0-21.33.1-1
1.33.1-1ubuntu0.1~esm1
Show 8 moreShow less
Affected packages
PackageAffectedFixed
aria2
SUSE:Package Hub 15
 before 1.33.1-bp150.3.7.1
1.33.1-bp150.3.7.1
aria2
openSUSE:Leap 15.0
 before 1.33.1-bp150.3.7.1
1.33.1-bp150.3.7.1
aria2
SUSE:Package Hub 15 SP1
 before 1.35.0-bp153.2.3.1
1.35.0-bp153.2.3.1
aria2
SUSE:Package Hub 15 SP2
 before 1.35.0-bp153.2.3.1
1.35.0-bp153.2.3.1
aria2
SUSE:Package Hub 15 SP3
 before 1.35.0-bp153.2.3.1
1.35.0-bp153.2.3.1
aria2
openSUSE:Leap 15.2
 before 1.35.0-bp153.2.3.1
1.35.0-bp153.2.3.1
aria2
openSUSE:Leap 15.3
 before 1.35.0-bp153.2.3.1
1.35.0-bp153.2.3.1
aria2
openSUSE:Tumbleweed
 before 1.36.0-1.2
1.36.0-1.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-3500 is a high vulnerability (CVSS 7.8) in Aria2 Project Aria2, published January 2, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in aria2 1.33.1-r1.

References

Show 20 moreShow less
This page doesn't list everything

Left out here: 58 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open