airsonic vulnerabilities and fixes

Recent CVEs affecting airsonic, with upgrade or downgrade steps. 3 tracked.

airsonic has 3 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 1. Most recent: 2019-04-07. Highest priority: CVE-2019-10908 (score 63/100).

• CVE-2019-10908 CRITICAL 9.8 DOWNGRADE In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils,
• CVE-2019-10907 CRITICAL 9.8 DOWNGRADE Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in Glob
• CVE-2018-20222 CRITICAL 9.8 UPGRADE XXE issue in Airsonic before 10.1.2 during parse.

FAQ

How do I fix airsonic vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is airsonic being exploited right now?

None of the tracked airsonic CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which airsonic CVE should I patch first?

CVE-2019-10908 currently ranks highest (63/100): In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, .

RSS feed for airsonic · ← Back to latest CVEs