id: PYSEC-2018-1
details: Unauthenticated access to cloudtoken daemon on Linux via network from version
  0.1.1 before version 0.1.24 allows attackers on the same subnet to gain temporary
  AWS credentials for the users' roles.
affected:
- package:
    name: cloudtoken
    ecosystem: PyPI
    purl: pkg:pypi/cloudtoken
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 0.1.1
    - fixed: 0.1.24
  versions:
  - 0.1.1
  - 0.1.10
  - 0.1.11
  - 0.1.12
  - 0.1.13
  - 0.1.14
  - 0.1.15
  - 0.1.16
  - 0.1.17
  - 0.1.18
  - 0.1.19
  - 0.1.2
  - 0.1.21
  - 0.1.22
  - 0.1.23
  - 0.1.3
  - 0.1.5
  - 0.1.6
  - 0.1.7
  - 0.1.8
  - 0.1.9
references:
- type: WEB
  url: 
    https://bitbucket.org/atlassian/cloudtoken/wiki/CVE-2018-13390%20-%20Exposed%20credentials%20in%20daemon%20mode%20on%20Linux
- type: ADVISORY
  url: https://github.com/advisories/GHSA-4fpg-j5mp-783g
aliases:
- CVE-2018-13390
- GHSA-4fpg-j5mp-783g
modified: "2021-06-10T06:50:35.324330Z"
published: "2018-08-10T15:29:00Z"