GHSA-2j6v-xpf3-xvrvHighCVSS 9.8

Use of Externally-Controlled Format String in wire-avs

Published
March 1, 2022
Last Modified
February 3, 2023

🔗 CVE IDs covered (1)

CVE-2021-41193 →

📋 Description

Impact

A remote format string vulnerability allowed an attacker to cause a denial of service or possibly execute arbitrary code.

Patches

  • The issue has been fixed in wire-avs 7.1.12 and is already included on all Wire products (currently used version is 8.0.x)

Workarounds

  • No workaround known

References

  • Fixed in commit https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe

For more information

If you have any questions or comments about this advisory feel free to email us at [email protected]

🎯 Affected products1

  • maven/com.wire:avs:< 7.1.12

🔗 References (4)