PT-2017-6648 · Tlslite · Tlslite

Vasyl Kaigorodov · Published 2017-06-13 · Updated 2022-05-14 · CVE-2015-3220

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions tlslite versions prior to 0.4.9

Description The issue allows remote attackers to trigger a denial of service, resulting in a runtime exception and process crash.

Recommendations For versions prior to 0.4.9, update to version 0.4.9 or later to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2015-3220

GHSA-4749-P7RX-8JJJ

PYSEC-2017-96

Affected Products

Tlslite

References · 9

• https://github.com/trevp/tlslite/commit/aca8d4f898b436ff6754e1a9ab96cae976c8a853 · Patch
• https://osv.dev/vulnerability/PYSEC-2017-96 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3220 · Security Note
• https://osv.dev/vulnerability/GHSA-4749-p7rx-8jjj · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/tlslite/PYSEC-2017-96.yaml · Note
• https://github.com/trevp/tlslite · Note
• https://groups.google.com/forum/#%21topic/tlslite-dev/MoWE7B0A4iU · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1254215 · Note
• https://groups.google.com/forum/#!topic/tlslite-dev/MoWE7B0A4iU · Note