What is GHSA-6m9g-jr8c-cqw3?

GHSA-6m9g-jr8c-cqw3 is a security advisory published by GitHub Security Advisories with High severity. Depth counting error in guard() leading to multiple potential security issues in aioxmpp

Which CVE IDs does GHSA-6m9g-jr8c-cqw3 cover?

GHSA-6m9g-jr8c-cqw3 covers the following CVE IDs: CVE-2019-1000007. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6m9g-jr8c-cqw3?

GHSA-6m9g-jr8c-cqw3 has a CVSS v3 base score of 7.4, published by GitHub Security Advisories.

Which products are affected by GHSA-6m9g-jr8c-cqw3?

GHSA-6m9g-jr8c-cqw3 affects 1 product, including: pip/aioxmpp:\u003c 0.10.3.

GHSA-6m9g-jr8c-cqw3HighCVSS 7.4

Depth counting error in guard() leading to multiple potential security issues in aioxmpp

Vendor

GitHub Security Advisories

Published

April 29, 2020

Last Modified

September 4, 2024

🔗 CVE IDs covered (1)

CVE-2019-1000007 →

📋 Description

Impact

Possible remote Denial of Service or Data Injection.

Patches

Patches are available in https://github.com/horazont/aioxmpp/pull/268. They have been backported to the 0.10 release series and 0.10.3 is the first release to contain the fix.

Workarounds

To make the bug exploitable, an error suppressing xso_error_handler is required. By not using xso_error_handlers or not using the suppression function, the vulnerability can be mitigated completely (to our knowledge).

References

The pull request contains a detailed description: https://github.com/horazont/aioxmpp/pull/268

For more information

If you have any questions or comments about this advisory:

Join our chat
Email the maintainer Jonas Schäfer

🎯 Affected products1

pip/aioxmpp:< 0.10.3