PT-2019-17425
CVE-2019-5039
·
تاريخ النشر
2019-08-20
·
تاريخ التحديث
2022-06-27
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Openweave-core version 4.0.2
Description
A command execution issue exists in the ASN1 certificate writing functionality. It can be triggered by a specially crafted weave certificate, leading to a heap-based buffer overflow and resulting in code execution. An attacker can exploit this by crafting a specific weave certificate.
Recommendations
For Openweave-core version 4.0.2, consider disabling the ASN1 certificate writing functionality until a patch is available. Restrict access to the weave certificate processing module to minimize the risk of exploitation.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾