PT-2019-17425 · Openwave · Openweave-Core

Claudio Bozzato + 1 · Published 2019-08-20 · Updated 2022-06-27 · CVE-2019-5039

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Openweave-core version 4.0.2

Description A command execution issue exists in the ASN1 certificate writing functionality. It can be triggered by a specially crafted weave certificate, leading to a heap-based buffer overflow and resulting in code execution. An attacker can exploit this by crafting a specific weave certificate.

Recommendations For Openweave-core version 4.0.2, consider disabling the ASN1 certificate writing functionality until a patch is available. Restrict access to the weave certificate processing module to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

CVE-2019-5039

Affected Products

Openweave-Core

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0802 · Exploit
• https://osv.dev/vulnerability/CVE-2019-5039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5039 · Security Note