PT-2019-8917 · Coapthon · Coapthon

Published 2019-04-02 · Updated 2019-10-03 · CVE-2018-12680

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CoAPthon versions 3.1, 4.0.0, 4.0.1, 4.0.2

Description The Serialize.deserialize() method mishandles certain exceptions, leading to a denial of service in applications that use this library when they receive crafted CoAP messages. This issue affects various applications, including the standard CoAP server, CoAP client, CoAP reverse proxy, and example collect CoAP server and client.

Recommendations For CoAPthon version 3.1, update to a version that fixes the issue with the Serialize.deserialize() method. For CoAPthon versions 4.0.0, 4.0.1, and 4.0.2, update to a version that fixes the issue with the Serialize.deserialize() method. As a temporary workaround, consider disabling the Serialize.deserialize() method until a patch is available.

Exploit

Fix

Resource Exhaustion

Deserialization of Untrusted Data

Weakness Enumeration

CWE-400

CWE-502

Related Identifiers

CVE-2018-12680

GHSA-5XC6-FPC7-4QVG

PYSEC-2019-165

Affected Products

Coapthon

References · 8

• 🔥 https://github.com/Tanganelli/CoAPthon/issues/135 · Exploit
• https://osv.dev/vulnerability/PYSEC-2019-165 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12680 · Security Note
• https://osv.dev/vulnerability/GHSA-5xc6-fpc7-4qvg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-12680 · Vendor Advisory
• https://github.com/Tanganelli/CoAPthon · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/coapthon/PYSEC-2019-165.yaml · Note
• https://github.com/advisories/GHSA-5xc6-fpc7-4qvg · Note