Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS01YzljLTZ4ODctZjl2bc4AAyfJ

zstd vulnerable to buffer overrun

A vulnerability was found in zstd v1.4.10, where an attacker can supply an empty string as an argument to the command line tool to cause buffer overrun.

Permalink: https://github.com/advisories/GHSA-5c9c-6x87-f9vm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01YzljLTZ4ODctZjl2bc4AAyfJ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 8 months ago
Updated: 2 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-5c9c-6x87-f9vm, CVE-2022-4899
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-4899
• https://github.com/facebook/zstd/issues/3200
• https://github.com/facebook/zstd/pull/3220
• https://github.com/sergey-dryabzhinsky/python-zstd/commit/c8a619aebdbd6b838fbfef6e19325a70f631a4c6
• https://github.com/pypa/advisory-database/tree/main/vulns/zstd/PYSEC-2023-121.yaml
• https://security.netapp.com/advisory/ntap-20230725-0005/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/JEHRBBYYTPA4DETOM5XAKGCP37NUTLOA/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/QYLDK6ODVC4LJSDULLX6Q2YHTFOWABCN/
• https://github.com/advisories/GHSA-5c9c-6x87-f9vm

Affected Packages