GHSA-c6fm-rgw4-8q73

CoAPthon3 vulnerable to Deserialization of Untrusted Data

Source: GitHub Advisory Database (reviewed) High CVE-2018-12679

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	CoAPthon3	<= 1.0.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

The Serialize.deserialize() method in CoAPthon3 1.0 and 1.0.1 mishandles certain exceptions, leading to a denial of service in applications that use this library (e.g., the standard CoAP server, CoAP client, example collect CoAP server and client) when they receive crafted CoAP messages.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-12679 advisory
https://github.com/Tanganelli/CoAPthon3/issues/16 web
https://github.com/Tanganelli/CoAPthon3 package
https://github.com/advisories/GHSA-c6fm-rgw4-8q73 advisory
https://github.com/pypa/advisory-database/tree/main/vulns/coapthon3/PYSEC-2019-166.yaml web