PT-2021-22434 · Unknown · Detect-Character-Encoding

Sonicdoe · Published 2021-08-31 · Updated 2021-09-08 · CVE-2021-39176

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions detect-character-encoding versions 0.3.0 and earlier

Description The issue is related to allocated memory not being released in detect-character-encoding versions 0.3.0 and earlier. This can cause a program using the library to become unavailable when running out of memory, especially if the program is accessible over the internet. The severity of the issue may vary depending on the specific implementation.

Recommendations For detect-character-encoding versions 0.3.0 and earlier, update to version 0.3.1 to resolve the issue. As a temporary workaround, consider restricting the use of the detect-character-encoding library in memory-intensive operations until the update is applied.

Exploit

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2021-39176

GHSA-5RWJ-J5M3-3CHJ

Affected Products

Detect-Character-Encoding

References · 10

• 🔥 https://github.com/sonicdoe/detect-character-encoding/security/advisories/GHSA-5rwj-j5m3-3chj · Exploit
• https://github.com/sonicdoe/detect-character-encoding/commit/d44356927b92e3b13e178071bf6d7c671766f588 · Patch
• https://github.com/sonicdoe/detect-character-encoding/pull/6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-39176 · Security Note
• https://osv.dev/vulnerability/GHSA-5rwj-j5m3-3chj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39176 · Vendor Advisory
• https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.3.1 · Note
• https://github.com/sonicdoe/detect-character-encoding · Note
• https://t.me/cvenotify/20460 · Telegram Post
• https://t.me/cibsecurity/28131 · Telegram Post