PT-2021-23312 · Pyo+1 · Pyo+1

Awen-Lio · Published 2021-12-17 · Updated 2021-12-27 · CVE-2021-41498

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pyo versions prior to 1.03

Description The issue allows attackers to conduct Denial of Service attacks by arbitrarily constructing an overlong client name or server name in the Server jack init function. This enables attackers to cause a buffer overflow, leading to a denial of service.

Recommendations For versions prior to 1.03, consider disabling the Server jack init function until a patch is available to prevent exploitation. Restrict access to the function to minimize the risk of denial of service attacks. Avoid using overlong client name or server names in the affected function to mitigate the risk.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2021-41498

GHSA-QJ27-32WP-GHRG

PYSEC-2021-890

Affected Products

Debian

Pyo

References · 14

• 🔥 https://github.com/belangeo/pyo/issues/221 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2021-41498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41498 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41498 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-890 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-41498 · Security Note
• https://osv.dev/vulnerability/GHSA-qj27-32wp-ghrg · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-41498 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-41498 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41498 · Vendor Advisory
• https://github.com/belangeo/pyo · Note
• https://github.com/belangeo/pyo/commit/017702c73332a8560c8554a36250a6da587a2418 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/pyo/PYSEC-2021-890.yaml · Note
• https://t.me/cibsecurity/34236 · Telegram Post