GitHub Advisoryadvisory · PyPI

GHSA-4r4c-66gf-g9g5 rockhopper Buffer Overflow vulnerability

MEDIUM Published 2024-05-28 Modified 2024-05-28 Official page ↗
Aliases
CVE-2022-4969
Ecosystem
PyPI
Packages
rockhopper
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-120
Reviewed
2024-05-28

Affected packages

• PyPI rockhopper: < 0.2.0 → fixed in 0.2.0

Description

A vulnerability, which was classified as critical, has been found in bwoodsend rockhopper up to 0.1.2. Affected by this issue is the function `count_rows` of the file `rockhopper/src/ragged_array.c` of the component Binary Parser. The manipulation of the argument raw leads to buffer overflow. Local access is required to approach this attack. Upgrading to version 0.2.0 is able to address this issue. The name of the patch is 1a15fad5e06ae693eb9b8908363d2c8ef455104e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-266312.

Related

Alias · CVE (1)

  • CVE-2022-4969 A vulnerability, which was classified as critical, has been found in bwoodsend rockhopper up to 0.1.2. vulnerability

Weakness · CWE (1)

  • CWE-120 Buffer Copy without Checking Size of Input weakness

References