CVE-2021-41500

Опубликовано: 17 дек. 2021

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

Incomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt.cholmod.solve, cvxopt.cholmod.spsolve), which allows attackers to conduct Denial of Service attacks by construct fake Capsule objects.

Ссылки

https://github.com/cvxopt/cvxopt/issues/193
Exploit
Issue Tracking
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CXTPM3DGVYTYQ54OFCMXZVWVOMR7JM2D/
https://github.com/cvxopt/cvxopt/issues/193
Exploit
Issue Tracking
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CXTPM3DGVYTYQ54OFCMXZVWVOMR7JM2D/

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:cvxopt_project:cvxopt:*:*:*:*:*:python:*:*

Версия до 1.2.6 (включая)

Конфигурация 2

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

EPSS

Процентиль: 50%

0.00274

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-697

Связанные уязвимости

CVE-2021-41500

CVSS3: 7.5

ubuntu

около 4 лет назад

CVE-2021-41500

msrc

5 месяцев назад

CVE-2021-41500

CVSS3: 7.5

debian

около 4 лет назад

Incomplete string comparison vulnerability exits in cvxopt.org cvxop < ...

GHSA-8rh6-h94m-vj54

CVSS3: 7.5

github

около 4 лет назад

Incorrect Comparison in cvxopt

EPSS

Процентиль: 50%

0.00274

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-697