Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWM2Zm0tcmd3NC04cTcz

CoAPthon3 vulnerable to Deserialization of Untrusted Data

The Serialize.deserialize() method in CoAPthon3 1.0 and 1.0.1 mishandles certain exceptions, leading to a denial of service in applications that use this library (e.g., the standard CoAP server, CoAP client, example collect CoAP server and client) when they receive crafted CoAP messages.

Permalink: https://github.com/advisories/GHSA-c6fm-rgw4-8q73
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWM2Zm0tcmd3NC04cTcz
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 5 years ago
Updated: 3 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Percentage: 0.00096
EPSS Percentile: 0.415

Identifiers: GHSA-c6fm-rgw4-8q73, CVE-2018-12679
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-12679
• https://github.com/Tanganelli/CoAPthon3/issues/16
• https://github.com/advisories/GHSA-c6fm-rgw4-8q73
• https://github.com/pypa/advisory-database/tree/main/vulns/coapthon3/PYSEC-2019-166.yaml

Repository: https://github.com/Tanganelli/CoAPthon3
Blast Radius: 1.0

Affected Packages