GitStock

horazont/aioxmpp · Security

Depth counting error in guard() leading to multiple potential security issues in aioxmpp

GHSA ID
GHSA-6m9g-jr8c-cqw3
CVE ID
CVE-2019-1000007
Severity
high
Published
Updated
CVSS
7.4 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v3
7.4 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4
8.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Description

Impact

Possible remote Denial of Service or Data Injection.

Patches

Patches are available in https://github.com/horazont/aioxmpp/pull/268. They have been backported to the 0.10 release series and 0.10.3 is the first release to contain the fix.

Workarounds

To make the bug exploitable, an error suppressing xso_error_handler is required. By not using xso_error_handlers or not using the suppression function, the vulnerability can be mitigated completely (to our knowledge).

References

The pull request contains a detailed description: https://github.com/horazont/aioxmpp/pull/268

For more information

If you have any questions or comments about this advisory:

CWEs

  • CWE-237 · Improper Handling of Structural Elements

References