GitHub Advisoryadvisory · Maven

GHSA-2j6v-xpf3-xvrv Use of Externally-Controlled Format String in wire-avs

HIGH Published 2022-03-01 Modified 2022-03-10 Official page ↗
Aliases
CVE-2021-41193
Ecosystem
Maven
Packages
com.wire:avs
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-134
Reviewed
2022-03-01

Affected packages

• Maven com.wire:avs: < 7.1.12 → fixed in 7.1.12

Description

Impact A remote format string vulnerability allowed an attacker to cause a denial of service or possibly execute arbitrary code. Patches • The issue has been fixed in wire-avs 7.1.12 and is already included on all Wire products (currently used version is 8.0.x) Workarounds • No workaround known References • Fixed in commit https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe For more information If you have any questions or comments about this advisory feel free to email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2021-41193 wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. vulnerability

Weakness · CWE (1)

  • CWE-134 Use of Externally-Controlled Format String weakness

References