PT-2019-8917 · Coapthon · Coapthon

Publicado 2019-04-02 · Atualizado 2019-10-03 · CVE-2018-12680

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CoAPthon versions 3.1, 4.0.0, 4.0.1, 4.0.2

Description The Serialize.deserialize() method mishandles certain exceptions, leading to a denial of service in applications that use this library when they receive crafted CoAP messages. This issue affects various applications, including the standard CoAP server, CoAP client, CoAP reverse proxy, and example collect CoAP server and client.

Recommendations For CoAPthon version 3.1, update to a version that fixes the issue with the Serialize.deserialize() method. For CoAPthon versions 4.0.0, 4.0.1, and 4.0.2, update to a version that fixes the issue with the Serialize.deserialize() method. As a temporary workaround, consider disabling the Serialize.deserialize() method until a patch is available.

Exploit

Correção

Resource Exhaustion

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-400

CWE-502

Identificadores relacionados

CVE-2018-12680

GHSA-5XC6-FPC7-4QVG

PYSEC-2019-165

Produtos afetados

Coapthon

Referências · 8

• 🔥 https://github.com/Tanganelli/CoAPthon/issues/135 · Exploit
• https://github.com/Tanganelli/CoAPthon · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/coapthon/PYSEC-2019-165.yaml · Nota
• https://osv.dev/vulnerability/PYSEC-2019-165 · Aviso do Fabricante
• https://github.com/advisories/GHSA-5xc6-fpc7-4qvg · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-12680 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-5xc6-fpc7-4qvg · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-12680 · Aviso do Fabricante