What is GHSA-p7xc-35m8-57pr?

GHSA-p7xc-35m8-57pr is a security advisory published by GitHub Security Advisories with High severity. FedMsg not properly completing message validation

Which CVE IDs does GHSA-p7xc-35m8-57pr cover?

GHSA-p7xc-35m8-57pr covers the following CVE IDs: CVE-2017-1000001. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p7xc-35m8-57pr?

GHSA-p7xc-35m8-57pr has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-p7xc-35m8-57pr?

GHSA-p7xc-35m8-57pr affects 1 product, including: pip/FedMsg:\u003c 0.18.2.

GHSA-p7xc-35m8-57prHighCVSS 7.5

FedMsg not properly completing message validation

Vendor

GitHub Security Advisories

Published

July 13, 2018

Last Modified

September 20, 2024

🔗 CVE IDs covered (1)

CVE-2017-1000001 →

📋 Description

FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on.

🎯 Affected products1

pip/FedMsg:< 0.18.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2017-1000001
https://github.com/advisories/GHSA-p7xc-35m8-57pr
https://github.com/fedora-infra/fedmsg/blob/0.18.2/CHANGELOG.rst
https://github.com/pypa/advisory-database/tree/main/vulns/fedmsg/PYSEC-2017-13.yaml