{"id":"CVE-2019-3500","aliases":["ALPINE-CVE-2019-3500","DEBIAN-CVE-2019-3500","DLA-1636-1","DLA-2873-1","EUVD-2019-13137","GHSA-g768-79g3-c28j","MGASA-2019-0036","UBUNTU-CVE-2019-3500","USN-4869-1","openSUSE-SU-2019:0050-1","openSUSE-SU-2021:1125-1","openSUSE-SU-2024:10631-1"],"status":"published","title":"aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and...","description":"aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00351,"percentile":0.28959,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2019-01-02T00:00:00Z","modified":"2026-10-20T10:52:43Z","fixes":[{"ecosystem":"Alpine:v3.7","package":"aria2","fixed_in":["1.33.1-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"aria2","fixed_in":["1.34.0-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"aria2","fixed_in":["1.34.0-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"aria2","fixed_in":["1.34.0-4"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"aria2","fixed_in":["1.18.8-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"aria2","fixed_in":["1.30.0-2+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"aria2","fixed_in":["1.25.0-1.1.mga6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"aria2","fixed_in":["1.18.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"aria2","fixed_in":["1.19.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"aria2","fixed_in":["1.33.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15","package":"aria2","fixed_in":["1.33.1-bp150.3.7.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"aria2","fixed_in":["1.33.1-bp150.3.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP1","package":"aria2","fixed_in":["1.35.0-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"aria2","fixed_in":["1.35.0-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"aria2","fixed_in":["1.35.0-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"aria2","fixed_in":["1.35.0-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"aria2","fixed_in":["1.35.0-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"aria2","fixed_in":["1.36.0-1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.7","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.1-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.0-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.0-4"}]}],"versions":["0.10.1-1","0.10.2+1-1","0.11.0-1","0.11.2-1","0.11.3-1","0.12.0-1","0.12.1-1","0.13.1+1-1","0.14.0-1","0.14.0-1+lenny1","0.14.0-1+lenny2","0.7.3-1","0.8.0-1","0.8.1-1","0.9.0-1","1.0.1-1","1.1.2-1","1.10.0-1","1.10.0-2","1.10.6-1","1.10.9-1","1.11.1-1","1.11.2-1","1.12.0-1","1.12.1-1","1.12.1-2","1.13.0-1","1.14.0-1","1.14.1-1","1.14.2-1","1.14.2-2","1.15.0-1","1.15.0-2","1.15.1-1","1.15.2-1","1.16.0-1","1.16.1-1","1.17.0-1","1.18.0-1","1.18.0-2","1.18.1-1","1.18.10-1","1.18.10-2","1.18.3-1","1.18.5-1","1.18.7-1","1.18.8-1","1.19.0-1","1.2.0-1","1.21.0-1","1.24.0-1","1.25.0-1","1.26.1-1","1.27.1-1","1.29.0-1","1.3.0-1","1.3.2-1","1.30.0-1","1.30.0-2","1.31.0-1","1.32.0-1","1.32.0-2","1.33.1-1","1.34.0-1","1.34.0-2","1.34.0-3","1.4.1-1","1.6.2-1","1.6.2-2","1.6.2-3","1.7.1-1","1.7.2-1","1.8.0-1","1.8.2-1","1.9.0-1","1.9.1-1","1.9.3-1","1.9.4-1","1.9.5-1"]},{"source":"osv","ecosystem":"Debian:14","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.0-4"}]}],"versions":["0.10.1-1","0.10.2+1-1","0.11.0-1","0.11.2-1","0.11.3-1","0.12.0-1","0.12.1-1","0.13.1+1-1","0.14.0-1","0.14.0-1+lenny1","0.14.0-1+lenny2","0.7.3-1","0.8.0-1","0.8.1-1","0.9.0-1","1.0.1-1","1.1.2-1","1.10.0-1","1.10.0-2","1.10.6-1","1.10.9-1","1.11.1-1","1.11.2-1","1.12.0-1","1.12.1-1","1.12.1-2","1.13.0-1","1.14.0-1","1.14.1-1","1.14.2-1","1.14.2-2","1.15.0-1","1.15.0-2","1.15.1-1","1.15.2-1","1.16.0-1","1.16.1-1","1.17.0-1","1.18.0-1","1.18.0-2","1.18.1-1","1.18.10-1","1.18.10-2","1.18.3-1","1.18.5-1","1.18.7-1","1.18.8-1","1.19.0-1","1.2.0-1","1.21.0-1","1.24.0-1","1.25.0-1","1.26.1-1","1.27.1-1","1.29.0-1","1.3.0-1","1.3.2-1","1.30.0-1","1.30.0-2","1.31.0-1","1.32.0-1","1.32.0-2","1.33.1-1","1.34.0-1","1.34.0-2","1.34.0-3","1.4.1-1","1.6.2-1","1.6.2-2","1.6.2-3","1.7.1-1","1.7.2-1","1.8.0-1","1.8.2-1","1.9.0-1","1.9.1-1","1.9.3-1","1.9.4-1","1.9.5-1"]},{"source":"osv","ecosystem":"Debian:8","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.8-1+deb8u1"}]}],"versions":["1.18.8-1"]},{"source":"osv","ecosystem":"Debian:9","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-2+deb9u1"}]}],"versions":["1.30.0-2"]},{"source":"osv","ecosystem":"Mageia:6","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-1.1.mga6"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu0.1~esm1"}]}],"versions":["1.17.0-1","1.18.0-1","1.18.0-1ubuntu2","1.18.0-2","1.18.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.0-1ubuntu0.1~esm1"}]}],"versions":["1.19.0-1","1.19.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.1-1ubuntu0.1~esm1"}]}],"versions":["1.32.0-1","1.32.0-2","1.33.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu0.1~esm1"}]}],"versions":["1.17.0-1","1.18.0-1","1.18.0-1ubuntu2","1.18.0-2","1.18.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.0-1ubuntu0.1~esm1"}]}],"versions":["1.19.0-1","1.19.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.1-1ubuntu0.1~esm1"}]}],"versions":["1.32.0-1","1.32.0-2","1.33.1-1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.1-bp150.3.7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.1-bp150.3.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"aria2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-1.2"}]}]}],"products":[{"vendor":"aria2_project","product":"aria2"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://github.com/aria2/aria2/issues/1329","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/01/msg00012.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MUUYDELHRLVE2AFNVR3OJ6ILUKVLY4B/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/532M22TAOOIY3J4XX4R7BLZHXJRUSBQ2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5OLPTVYHJZJ2MVEXJCNPXBSFPVPE4XX/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://usn.ubuntu.com/3965-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00039.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3500"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/532M22TAOOIY3J4XX4R7BLZHXJRUSBQ2/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MUUYDELHRLVE2AFNVR3OJ6ILUKVLY4B/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5OLPTVYHJZJ2MVEXJCNPXBSFPVPE4XX/"},{"url":"https://github.com/advisories/GHSA-g768-79g3-c28j"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-3500","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-3500","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0036.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-3500","tags":["report"]},{"url":"https://github.com/aria2/aria2/commit/37368130ca7de5491a75fd18a20c5c5cc641824a","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3965-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4869-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3500","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/V3DTAGWFCA4AIBZW6G3SJDKHWFKCAUFG/#V3DTAGWFCA4AIBZW6G3SJDKHWFKCAUFG","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1120488","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3500","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/X3RWOJOX6LLCQBYIEUS2KKAEEPLXW6WP/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189107","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-3500","description":"aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.","status":"published","published":"2019-01-02T07:00:00Z","modified":"2024-08-04T19:12:09.519Z","updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-13137","description":"aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.","status":"published","published":"2019-01-02T07:00:00Z","modified":"2024-08-04T19:12:09Z","updated_at":"2026-11-03T03:06:55.481882Z"}],"ghsa":[{"id":"GHSA-g768-79g3-c28j","title":"aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and...","description":"aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.","status":"published","published":"2022-05-13T01:02:45Z","modified":"2023-02-01T05:02:31Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:49:56.179573Z"}],"nvd":[{"id":"CVE-2019-3500","description":"aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.","status":"published","published":"2019-01-02T07:29:00.197Z","modified":"2026-06-17T02:35:12.757Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:05:02.989216Z"}],"osv":[{"id":"ALPINE-CVE-2019-3500","description":"aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.","status":"published","published":"2019-01-02T07:29:00.197Z","modified":"2026-09-21T06:17:52.51575291Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"CVE-2019-3500","description":"aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.","status":"published","published":"2019-01-02T07:29:00.197Z","modified":"2026-10-20T10:52:43.075063906Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-3500","description":"aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.","status":"published","published":"2019-01-02T07:29:00.197Z","modified":"2026-09-21T07:01:24.510259567Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"UBUNTU-CVE-2019-3500","description":"aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.","status":"published","published":"2019-01-02T00:00:00Z","modified":"2026-02-04T04:09:57.52376Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"DLA-1636-1","title":"aria2 - security update","status":"published","published":"2019-01-22T00:00:00Z","modified":"2026-03-09T01:23:24.362835Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2873-1","title":"aria2 - security update","status":"published","published":"2021-12-31T00:00:00Z","modified":"2026-03-09T01:21:30.885003Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2019-0036","title":"Updated aria2 package fixes security vulnerability","description":"It was observed that URL's which gets downloaded via \"--log=\" attribute\nstores sensitive information. This update fixes that.\n","status":"published","published":"2019-01-15T22:15:34Z","modified":"2026-04-16T04:40:54.007258296Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0050-1","title":"Security update for aria2","description":"This update for aria2 fixes the following security issue:\n\n- CVE-2019-3500: Metadata and potential password leaks via --log= (boo#1120488)\n","status":"published","published":"2019-04-04T14:56:25Z","modified":"2026-02-04T03:24:58.428976Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2021:1125-1","title":"Security update for aria2","description":"This update for aria2 fixes the following issues:\n\nUpdate to version 1.35.0:\n\n* Drop SSLv3.0 and TLSv1.0 and add TLSv1.3\n* TLSv1.3 support is added for GNUTLS and OpenSSL.\n* Platform: Fix compilation without deprecated OpenSSL APIs\n* Remove linux getrandom and use C++ stdlib instead\n* Don't send Accept Metalink header if Metalink is disabled\n\n- Move bash completion to better location\n\nUpdate to version 1.34.0:\n\n* UnknownLengthPieceStorage: return piece length show something\n  in console status when downloading items with unknown content length\n* Fix bug that signal handler does not work with libaria2 when\n  aria2::RUN_ONCE is passed to aria2::run().\n* Retry on HTTP 502\n","status":"published","published":"2021-08-10T04:07:03Z","modified":"2026-02-04T02:51:00.062928Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10631-1","title":"aria2-1.36.0-1.2 on GA media","description":"These are all security issues fixed in the aria2-1.36.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:24:14.936787Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-4869-1","title":"aria2 vulnerability","description":"It was discovered that aria2 could accidentally leak authentication data.\nAn attacker could possibly use this to gain access to sensitive information.","status":"published","published":"2021-03-15T22:58:32Z","modified":"2026-06-29T13:48:17.315894366Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}