wireapp/wire-avs · Security
Use of Externally-Controlled Format String in wire-avs
- GHSA ID
- GHSA-2j6v-xpf3-xvrv
- CVE ID
- CVE-2021-41193
- Severity
- high
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Impact
A remote format string vulnerability allowed an attacker to cause a denial of service or possibly execute arbitrary code.
Patches
- The issue has been fixed in wire-avs 7.1.12 and is already included on all Wire products (currently used version is 8.0.x)
Workarounds
- No workaround known
References
For more information
If you have any questions or comments about this advisory feel free to email us at [email protected]
CWEs
- CWE-134 · Use of Externally-Controlled Format String