Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0yajZ2LXhwZjMteHZyds0vfA

Use of Externally-Controlled Format String in wire-avs

Impact

A remote format string vulnerability allowed an attacker to cause a denial of service or possibly execute arbitrary code.

Patches

• The issue has been fixed in wire-avs 7.1.12 and is already included on all Wire products (currently used version is 8.0.x)

Workarounds

• No workaround known

References

• Fixed in commit https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe

For more information

If you have any questions or comments about this advisory feel free to email us at [email protected]

Permalink: https://github.com/advisories/GHSA-2j6v-xpf3-xvrv
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yajZ2LXhwZjMteHZyds0vfA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 years ago
Updated: over 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-2j6v-xpf3-xvrv, CVE-2021-41193
References:

• https://github.com/wireapp/wire-avs/security/advisories/GHSA-2j6v-xpf3-xvrv
• https://nvd.nist.gov/vuln/detail/CVE-2021-41193
• https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe
• https://github.com/advisories/GHSA-2j6v-xpf3-xvrv

Repository: https://github.com/wireapp/wire-avs
Blast Radius: 0.0

Affected Packages