What is GHSA-6g87-ff9q-v847?

GHSA-6g87-ff9q-v847 is a security advisory published by GitHub Security Advisories with High severity. websockets is vulnerable to denial of service by memory exhaustion

Which CVE IDs does GHSA-6g87-ff9q-v847 cover?

GHSA-6g87-ff9q-v847 covers the following CVE IDs: CVE-2018-1000518. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6g87-ff9q-v847?

GHSA-6g87-ff9q-v847 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-6g87-ff9q-v847?

GHSA-6g87-ff9q-v847 affects 1 product, including: pip/websockets:\u003e= 4.0, \u003c 5.0.

GHSA-6g87-ff9q-v847HighCVSS 7.5

websockets is vulnerable to denial of service by memory exhaustion

Vendor

GitHub Security Advisories

Published

September 17, 2018

Last Modified

November 19, 2024

🔗 CVE IDs covered (1)

CVE-2018-1000518 →

📋 Description

The Python websockets library version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appears to be exploitable via sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in version 5.0

🎯 Affected products1

pip/websockets:>= 4.0, < 5.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000518
https://github.com/aaugustin/websockets/pull/407
https://github.com/pypa/advisory-database/tree/main/vulns/websockets/PYSEC-2018-79.yaml
https://github.com/advisories/GHSA-6g87-ff9q-v847