PT-2018-9415 · Aaugustin+1 · Uwebsockets+1

Aaugustin · Publicado 2018-06-26 · Atualizado 2024-07-12 · CVE-2018-1000518

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions aaugustin websockets versions 4.0 through 4.0

Description The issue is related to improper handling of highly compressed data, which can result in Denial of Service by memory exhaustion. This can be exploited by sending a specially crafted frame on an established connection. The vulnerability appears to have been fixed in version 5.

Recommendations For version 4, update to version 5 to resolve the issue. As a temporary workaround, consider configuring the websockets library with compression=None to prevent exploitation.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2018-1000518

GHSA-6G87-FF9Q-V847

OPENSUSE-SU-2024:11280-1

OPENSUSE-SU-2024:14166-1

PYSEC-2018-79

SUSE-SU-2023:2783-1

SUSE-SU-2023:2783-2

SUSE-SU-2023_2783-1

SUSE-SU-2023_2783-2

Produtos afetados

Suse

Uwebsockets

Referências · 74

• 🔥 https://github.com/aaugustin/websockets/pull/407 · Exploit
• https://github.com/pyca/cryptography/issues/5615 · Nota
• https://github.com/aaugustin/websockets · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/websockets/PYSEC-2018-79.yaml · Nota
• https://bugzilla.suse.com/1133277 · Nota
• https://jira.suse.com/browse/SLE-24629 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000518 · Nota de Segurança
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• https://lists.suse.com/pipermail/sle-security-updates/attachments/20230705/4b5aee7b/attachment.htm · Nota
• https://t.me/cvenotify/26607 · Publicação no Telegram
• https://suse.com/security/cve/CVE-2021-22570 · Nota
• https://osv.dev/vulnerability/CVE-2018-1000518 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-1000518.html · Nota
• https://safe-surf.ru/specialists/bulletins-nkcki/682554 · Nota de Segurança
• https://suse.com/security/cve/CVE-2022-3171 · Nota