Описание
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
A flaw was found in MessagePack for Python, a serializer implementation. This vulnerability, categorized as a Use-After-Free (CWE-416), occurs when the Unpacker component is reused after an error. A remote attacker could exploit this by repeatedly providing untrusted input, leading to an out-of-bounds read and a system crash. This can result in a Denial of Service (DoS) attack.
Отчет
This Important flaw in MessagePack for Python can lead to a denial of service. An out-of-bounds read and subsequent process crash may occur if an Unpacker instance is reused after an error has been caught, potentially allowing an attacker to disrupt services that process MessagePack data.
Меры по смягчению последствий
To mitigate this issue, applications utilizing MessagePack for Python should be reviewed to ensure that Unpacker instances are not reused after an error has occurred during unpacking. Instead, a new Unpacker instance should be created for subsequent operations.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Pen Drive Powered by Red Hat Lightspeed | pen-drive/pen-drive-scanner-rhel9 | Not affected | ||
| Red Hat AI Inference Server | rhaiis/vllm-cuda-rhel9 | Not affected | ||
| Red Hat AI Inference Server | rhaiis/vllm-rocm-rhel9 | Not affected | ||
| Red Hat AI Inference Server | rhaiis/vllm-spyre-rhel9 | Not affected | ||
| Red Hat AI Inference Server | rhaiis/vllm-tpu-rhel9 | Not affected | ||
| Red Hat AI Inference Server | rhaii/vllm-cpu-rhel9 | Not affected | ||
| Red Hat AI Inference Server | rhaii/vllm-cuda-rhel9 | Not affected | ||
| Red Hat AI Inference Server | rhaii/vllm-gaudi-rhel9 | Not affected | ||
| Red Hat AI Inference Server | rhaii/vllm-rocm-rhel9 | Not affected | ||
| Red Hat AI Inference Server | rhaii/vllm-tpu-rhel9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error
MessagePack is the serializer implementation for Python msgpack.org. P ...
EPSS
7.5 High
CVSS3