CVE-2018-12680

Published: Apr 2, 2019Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The Serialize.deserialize() method in CoAPthon 3.1, 4.0.0, 4.0.1, and 4.0.2 mishandles certain exceptions, leading to a denial of service in applications that use this library (e.g., the standard CoAP server, CoAP client, CoAP reverse proxy, example collect CoAP server and client) when they receive crafted CoAP messages.

Affected (4)

Products: Coapthon Project: Coapthon

Coapthon Project

1 product

Coapthon

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Coapthon Project Coapthon	Version 3.1
Coapthon Project Coapthon	Version 4.0.0
Coapthon Project Coapthon	Version 4.0.1
Coapthon Project Coapthon	Version 4.0.2

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://github.com/Tanganelli/CoAPthon/issues/135

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://github.com/Tanganelli/CoAPthon/issues/135

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.