CPANSA-Sereal-Encoder-2019-11922-zstd: Sereal-Encoder vulnerability

Publisher giterlizzi Document category csaf_security_advisory
Initial release date 2019-07-25T00:00:00 Engine CSAF Perl Toolkit 0.26
Current release date 2019-07-25T00:00:00 Build Date
Current version 1 Status final
CVSS v3.1 Base Score 8.1 Severity
Original language Language en
Also referred to

Vulnerability Description

A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.

Vulnerabilities

CVE-2019-11922

Vulnerability Description

A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.

Weakness CWE-362 : Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Product status

Known affected
Product Score
Sereal-Encoder greater than or equal 4.001_001 and less than 4.009_002
CVSS Version CVSS Vector CVSS Base Score CVSS Base Severity
3.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H 8.1 High
2.0 AV:N/AC:M/Au:N/C:P/I:P/A:P 6.8 Medium

giterlizzi

Namespace: https://github.com/giterlizzi/

gdt@cpan.org

References

Revision history

Version Date of the revision Summary of the revision
1 Thu Jul 25 00:00:00 2019 First release

Sharing rules

TLP:WHITE
For the TLP version see: https://www.first.org/tlp/