PT-2020-7909 · Adobe · Flash Player

Agarri_Fr + 1 · Published 2020-01-15 · Updated 2022-05-24 · CVE-2015-8549

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: PyAMF versions prior to 0.8.0

Description: The issue allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload. This is due to an XML external entity (XXE) vulnerability. PyAMF provides Action Message Format (AMF) support for Python, compatible with the Adobe Flash Player, and includes integration with various Python web frameworks.

Recommendations: For versions prior to 0.8.0, update to version 0.8.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the AMF payload processing functionality until a patch is applied.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2015-8549

GHSA-M7M4-4VM8-55WG

PYSEC-2020-339

Affected Products

Flash Player

References · 11

• https://github.com/hydralabs/pyamf/pull/58 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-8549 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-339 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m7m4-4vm8-55wg · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/pyamf/PYSEC-2020-339.yaml · Note
• https://github.com/hydralabs/pyamf/releases/tag/v0.8.0 · Note
• https://github.com/hydralabs/pyamf · Note
• https://pypi.org/project/pyamf · Note
• http://securityfocus.com/archive/1/archive/1/537151/100/0/threaded · Note
• https://github.com/advisories/GHSA-m7m4-4vm8-55wg · Note
• http://ocert.org/advisories/ocert-2015-011.html · Note