GitHub Advisoryadvisory · PyPI

GHSA-6m9g-jr8c-cqw3 Depth counting error in guard() leading to multiple potential security issues in aioxmpp

HIGH Published 2020-04-29 Modified 2024-09-04 Official page ↗
Aliases
CVE-2019-1000007
Ecosystem
PyPI
Packages
aioxmpp
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-237
Reviewed
2020-04-29

Affected packages

• PyPI aioxmpp: < 0.10.3 → fixed in 0.10.3

Description

Impact Possible remote Denial of Service or Data Injection. Patches Patches are available in https://github.com/horazont/aioxmpp/pull/268. They have been backported to the 0.10 release series and 0.10.3 is the first release to contain the fix. Workarounds To make the bug exploitable, an error suppressing ``xso_error_handler`` is required. By not using ``xso_error_handlers`` or not using the suppression function, the vulnerability can be mitigated completely (to our knowledge). References The pull request contains a detailed description: https://github.com/horazont/aioxmpp/pull/268 For more information If you have any questions or comments about this advisory: • Join our chat • Email the maintainer Jonas Schäfer

Related

Alias · CVE (1)

  • CVE-2019-1000007 aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser, rollback during… vulnerability

Weakness · CWE (1)

  • CWE-237 Improper Handling of Structural Elements weakness

References