PT-2019-11261 · Aioxmpp · Aioxmpp

Horazont · Publicado 2019-02-04 · Atualizado 2021-07-21 · CVE-2019-1000007

Positive Technologies (AI Summary)

CVSS v4.0

8.3

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: aioxmpp versions 0.10.2 and earlier

Description: The issue is related to improper handling of structural elements in the Stanza Parser, specifically during error processing in the aioxmpp.xso.model.guard function. This can result in Denial of Service or potentially allow data injection in a different context. A crafted stanza sent to an application using the vulnerable components can cause the application to reconnect, potentially leading to data loss. The vulnerability appears to be exploitable remotely.

Recommendations: For versions 0.10.2 and earlier, update to version 0.10.3 or later to resolve the issue. As a temporary workaround, consider not using xso error handlers or avoiding the use of the error suppression function to mitigate the vulnerability.

Exploit

Correção

Enumeração de Fraquezas

CWE-237

Identificadores relacionados

CVE-2019-1000007

GHSA-32F7-CMR3-VPJV

GHSA-6M9G-JR8C-CQW3

PYSEC-2019-1

Produtos afetados

Aioxmpp

Referências · 18

• 🔥 https://github.com/horazont/aioxmpp/pull/268 · Exploit
• https://github.com/pypa/advisory-database/tree/main/vulns/aioxmpp/PYSEC-2019-1.yaml · Nota
• https://github.com/horazont/aioxmpp/commit/29ff0838a40f58efe30a4bbcea95aa8dab7da475 · Nota
• https://github.com/horazont/aioxmpp/security/advisories/GHSA-6m9g-jr8c-cqw3 · Nota
• https://github.com/horazont/aioxmpp · Nota
• https://github.com/horazont/aioxmpp/commit/f151f920f439d97d4103fc11057ed6dc34fe98be · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000007 · Nota de Segurança
• https://ubuntu.com/security/CVE-2019-1000007 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-1000007 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-1000007 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2019-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-32f7-cmr3-vpjv · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1000007 · Aviso do Fabricante
• https://github.com/advisories/GHSA-6m9g-jr8c-cqw3 · Nota
• https://osv.dev/vulnerability/GHSA-6m9g-jr8c-cqw3 · Aviso do Fabricante