CVEvulnerability
CVE-2021-29508
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-05-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- CVSS 3.1 ([email protected])
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:P
- Weaknesses
- CWE-502
Description
Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer. e.g. using a surrogate on the sender end, an attacker can pass information about a different type for the receiving end. And by doing so allowing the serializer to create any type on the deserializing end. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300?view=vs-2019. This also applies to the fork of Wire.
Affected configurations
• asynkron wire
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://github.com/AsynkronIT/Wire/security/advisories/GHSA-hpw7-3vq3-mmv6 Exploit, Third Party Advisory
- https://www.nuget.org/packages/Wire/ Third Party Advisory
- https://github.com/AsynkronIT/Wire/security/advisories/GHSA-hpw7-3vq3-mmv6 Exploit, Third Party Advisory
- https://www.nuget.org/packages/Wire/ Third Party Advisory