PT-2021-23389 · Faust+1 · Faust+1

Elmanto · Published 2021-12-31 · Updated 2024-11-19 · CVE-2021-41737

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Faust version 2.23.1

Description The issue arises when an input file contains specific lines, including "// r visualisation tCst", "//process = +: L: abM-^Q;", and "process = route(3333333333333333333,2,1,2,3,1) : *;", leading to stack consumption. This poses a high risk and has been exploited in specific versions.

Recommendations For Faust version 2.23.1, update to the latest version available to mitigate the risk of stack consumption due to the vulnerable input file processing.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2021-41737

Affected Products

Debian

Faust

References · 13

• https://ubuntu.com/security/CVE-2021-41737 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41737 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41737 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-41737 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-41737 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-41737 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-41737 · Security Note
• https://github.com/grame-cncm/faust/tree/e682dbeeb7cc0ec9a1fcb6872f53433e454aa233 · Note
• https://github.com/grame-cncm/faust/issues/653 · Note
• https://t.me/cvedetector/10442 · Telegram Post
• https://twitter.com/CVEnew/status/1855740189479739573 · Twitter Post
• https://twitter.com/transilienceai/status/1856752401979773084 · Twitter Post
• https://t.me/cvenotify/101248 · Telegram Post