CVE-2018-1000518

Опубликовано: 26 июн. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in 5.

Ссылки

https://github.com/aaugustin/websockets/pull/407
Exploit
Patch
Third Party Advisory
https://github.com/aaugustin/websockets/pull/407
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:websockets_project:websockets:4.0:*:*:*:*:python:*:*

EPSS

Процентиль: 36%

0.00155

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-400

Связанные уязвимости

GHSA-6g87-ff9q-v847

CVSS3: 7.5

github

больше 7 лет назад

websockets is vulnerable to denial of service by memory exhaustion

SUSE-SU-2023:2783-2

suse-cvrf

больше 2 лет назад

Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websockets

SUSE-SU-2023:2783-1