id: PYSEC-2018-101
details: SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.
affected:
- package:
    name: sickrage
    ecosystem: PyPI
    purl: pkg:pypi/sickrage
  ranges:
  - type: GIT
    repo: https://github.com/SickRage/SickRage
    events:
    - introduced: "0"
    - fixed: 8156a74a68aea930d1e1047baba8b115c3abfc44
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 9.3.2
  versions:
  - 6.0.47
  - 6.0.48
  - 6.0.49
  - 6.0.50
  - 6.0.51
  - 6.0.52
  - 6.0.53
  - 6.0.54
  - 6.0.55
  - 7.0.0
  - 7.0.1
  - 7.0.10
  - 7.0.12
  - 7.0.16
  - 7.0.17
  - 7.0.18
  - 7.0.19
  - 7.0.2
  - 7.0.20
  - 7.0.21
  - 7.0.22
  - 7.0.23
  - 7.0.3
  - 7.0.5
  - 7.0.6
  - 7.0.7
  - 7.0.8
  - 7.0.9
  - 8.0.0
  - 8.0.1
  - 8.0.11
  - 8.0.2
  - 8.0.3
  - 8.0.4
  - 8.0.5
  - 8.0.6
  - 8.0.7
  - 8.0.9
  - 8.1.0
  - 8.1.1
  - 8.1.2
  - 8.1.3
  - 8.1.4
  - 8.1.5
  - 8.1.7
  - 8.1.8
  - 8.1.9
  - 8.2.0
  - 8.2.1
  - 8.2.2
  - 8.2.3
  - 8.2.4
  - 8.3.0
  - 8.3.1
  - 8.3.2
  - 8.3.3
  - 8.3.4
  - 8.3.7
  - 8.3.8
  - 8.3.9
  - 8.4.0
  - 8.4.1
  - 8.4.2
  - 8.4.3
  - 8.4.5
  - 8.4.6
  - 8.4.7
  - 8.5.0
  - 8.5.1
  - 8.5.3
  - 8.5.6
  - 8.6.3
  - 8.6.4
  - 8.6.5
  - 8.6.6
  - 8.6.7
  - 8.6.8
  - 8.6.9
  - 8.7.0
  - 8.7.1
  - 8.7.2
  - 8.7.3
  - 8.7.4
  - 8.7.5
  - 8.7.6
  - 8.7.7
  - 8.7.8
  - 8.7.9
  - 8.8.0
  - 8.8.1
  - 8.8.2
  - 8.8.3
  - 8.8.4
  - 8.8.5
  - 8.8.6
  - 8.8.7
  - 8.8.8
  - 8.9.0
  - 8.9.1
  - 8.9.2
  - 8.9.3
  - 8.9.4
  - 8.9.5
  - 8.9.7
  - 8.9.8
  - 8.9.9
  - 9.0.0
  - 9.0.1
  - 9.0.10
  - 9.0.11
  - 9.0.12
  - 9.0.13
  - 9.0.14
  - 9.0.15
  - 9.0.16
  - 9.0.17
  - 9.0.18
  - 9.0.19
  - 9.0.2
  - 9.0.20
  - 9.0.21
  - 9.0.22
  - 9.0.23
  - 9.0.24
  - 9.0.25
  - 9.0.26
  - 9.0.27
  - 9.0.28
  - 9.0.29
  - 9.0.3
  - 9.0.30
  - 9.0.31
  - 9.0.33
  - 9.0.34
  - 9.0.35
  - 9.0.37
  - 9.0.38
  - 9.0.39
  - 9.0.4
  - 9.0.40
  - 9.0.41
  - 9.0.42
  - 9.0.43
  - 9.0.44
  - 9.0.5
  - 9.0.6
  - 9.0.61
  - 9.0.62
  - 9.0.63
  - 9.0.65
  - 9.0.66
  - 9.0.67
  - 9.0.68
  - 9.0.69
  - 9.0.70
  - 9.0.71
  - 9.0.72
  - 9.0.73
  - 9.0.74
  - 9.0.75
  - 9.0.78
  - 9.0.8
  - 9.0.81
  - 9.0.82
  - 9.0.83
  - 9.0.84
  - 9.0.85
  - 9.0.87
  - 9.0.88
  - 9.0.89
  - 9.0.9
  - 9.0.90
  - 9.1.1
  - 9.1.10
  - 9.1.13
  - 9.1.14
  - 9.1.15
  - 9.1.16
  - 9.1.17
  - 9.1.18
  - 9.1.19
  - 9.1.20
  - 9.1.23
  - 9.1.24
  - 9.1.25
  - 9.1.26
  - 9.1.27
  - 9.1.28
  - 9.1.29
  - 9.1.3
  - 9.1.30
  - 9.1.31
  - 9.1.32
  - 9.1.33
  - 9.1.34
  - 9.1.35
  - 9.1.36
  - 9.1.38
  - 9.1.39
  - 9.1.4
  - 9.1.42
  - 9.1.43
  - 9.1.44
  - 9.1.45
  - 9.1.46
  - 9.1.47
  - 9.1.48
  - 9.1.49
  - 9.1.5
  - 9.1.50
  - 9.1.51
  - 9.1.52
  - 9.1.53
  - 9.1.54
  - 9.1.55
  - 9.1.56
  - 9.1.57
  - 9.1.58
  - 9.1.59
  - 9.1.6
  - 9.1.60
  - 9.1.62
  - 9.1.63
  - 9.1.64
  - 9.1.65
  - 9.1.66
  - 9.1.67
  - 9.1.68
  - 9.1.69
  - 9.1.7
  - 9.1.70
  - 9.1.72
  - 9.1.74
  - 9.1.76
  - 9.1.77
  - 9.1.78
  - 9.1.8
  - 9.1.9
  - 9.2.10
  - 9.2.100
  - 9.2.101
  - 9.2.11
  - 9.2.13
  - 9.2.14
  - 9.2.15
  - 9.2.16
  - 9.2.17
  - 9.2.18
  - 9.2.19
  - 9.2.2
  - 9.2.20
  - 9.2.21
  - 9.2.22
  - 9.2.23
  - 9.2.24
  - 9.2.25
  - 9.2.26
  - 9.2.27
  - 9.2.29
  - 9.2.30
  - 9.2.31
  - 9.2.32
  - 9.2.34
  - 9.2.36
  - 9.2.38
  - 9.2.4
  - 9.2.40
  - 9.2.42
  - 9.2.43
  - 9.2.44
  - 9.2.47
  - 9.2.48
  - 9.2.5
  - 9.2.51
  - 9.2.52
  - 9.2.53
  - 9.2.54
  - 9.2.55
  - 9.2.56
  - 9.2.57
  - 9.2.61
  - 9.2.62
  - 9.2.63
  - 9.2.64
  - 9.2.65
  - 9.2.66
  - 9.2.67
  - 9.2.68
  - 9.2.69
  - 9.2.70
  - 9.2.71
  - 9.2.73
  - 9.2.76
  - 9.2.77
  - 9.2.78
  - 9.2.79
  - 9.2.8
  - 9.2.80
  - 9.2.83
  - 9.2.84
  - 9.2.85
  - 9.2.86
  - 9.2.87
  - 9.2.89
  - 9.2.9
  - 9.2.90
  - 9.2.91
  - 9.2.92
  - 9.2.93
  - 9.2.94
  - 9.2.95
  - 9.2.97
  - 9.2.98
  - 9.2.99
references:
- type: FIX
  url: 
    https://github.com/SickRage/SickRage/commit/8156a74a68aea930d1e1047baba8b115c3abfc44
- type: WEB
  url: 
    https://github.com/SickRage/sickrage.github.io/blob/master/sickrage-news/CHANGES.md
- type: WEB
  url: https://www.exploit-db.com/exploits/44545/
- type: ADVISORY
  url: https://github.com/advisories/GHSA-jrcv-3c5h-rh3q
aliases:
- CVE-2018-9160
- GHSA-jrcv-3c5h-rh3q
modified: "2021-08-27T03:22:21.352713Z"
published: "2018-03-31T21:29:00Z"