aaugustin websockets denial of service vulnerability

aaugustin websockets is a library for building WebSocket servers and clients in Python. A security vulnerability exists in aaugustin websockets version 4. An attacker can exploit this vulnerability to cause a denial of service memory exhaustion...

Denial Of Service (DoS)

websockets is vulnerable to denial of service attacks. The application does not properly enforce a size limit when decompressing frames, allowing a malicious user to pass a zip bomb to the application to consume memory and crash it...

CVE-2018-1000518

aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sendi...

CVE-2018-1000518

aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sendi...

PYSEC-2018-79

aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sendi...

PYSEC-2018-79

aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sendi...

bonsai-python (>=0.2.1, <=0.4.0), discord-py-legacy (0.16.13) +6 more potentially affected by CVE-2018-1000518 via websockets (3.4.0)

websockets PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - bonsai-python =0.2.1, =0.17.0b1, =0.1.3, =1.0.0, =2.0.1 - textxls 1.1.0 Source cves: CVE-2018-1000518 Source advisory: OSV:PYSEC-2018-79...

bitshares (>=0.1.0, <=0.1.5), geoffrey (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2018-1000518 via websockets (2.0.0)

websockets PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - bitshares =0.1.0, =0.1.0, =0.1.1 - golos 0.2.3 - uptick 0.1.2 Source cves: CVE-2018-1000518 Source advisory: OSV:PYSEC-2018-79...

geoffrey (0.1.2) potentially affected by CVE-2018-1000518 via websockets (2.1.0)

websockets PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - geoffrey 0.1.2 Source cves: CVE-2018-1000518 Source advisory: OSV:PYSEC-2018-79...

django-private-chat (>=0.1.0, <=0.2.2) potentially affected by CVE-2018-1000518 via websockets (3.2.0)

websockets PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - django-private-chat =0.1.0, =0.2.2 Source cves: CVE-2018-1000518 Source advisory: OSV:PYSEC-2018-79...

Design/Logic Flaw

aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sendi...

chromewhip (>=0.2.2, <=0.2.16), gdax-python-api (0.1.0) +3 more potentially affected by CVE-2018-1000518 via websockets (3.3.0)

websockets PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - chromewhip =0.2.2, =0.2.16 - gdax-python-api 0.1.0 - pyvesteltv 0.1.1 - qcodes 0.1.9 - theia 0.9.1 Source cves: CVE-2018-1000518 Source...

discord-py-unofficial (>=0.17.0b4, <=0.17.0b5), missinglinkai-resource-manager-docker (>=1.3.457, <=2.1.914) +6 more potentially affected by CVE-2018-1000518 via websockets (4.0.1)

websockets PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - discord-py-unofficial =0.17.0b4, =1.3.457, =0.2.0a28, =0.0.4, =0.1.0a12, =0.1.0a13 - web3 4.3.0 Source cves: CVE-2018-1000518 Source advisor...

CVE-2018-1000518

aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sendi...

discord-py-unofficial (>=0.17.0b4, <=0.17.0b5), missinglinkai-resource-manager-docker (>=1.3.457, <=2.1.914) +6 more potentially affected by CVE-2018-1000518 via websockets (4.0.1)

websockets PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - discord-py-unofficial =0.17.0b4, =1.3.457, =0.2.0a28, =0.0.4, =0.1.0a12, =0.1.0a13 - web3 4.3.0 Source cves: CVE-2018-1000518 Source advisor...

CVE-2018-1000518

CVE-2018-1000518 concerns a vulnerability in the Python websockets library (aaugustin websockets) where version 4 allows a Denial of Service via memory exhaustion. The issue arises from improper handling of highly compressed data (Data Amplification, CWE-409) when compression is enabled (i.e., no...

CVE-2018-1000518

aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sendi...

PT-2018-9415

Name of the Vulnerable Software and Affected Versions aaugustin websockets versions 4.0 through 4.0 Description The issue is related to improper handling of highly compressed data, which can result in Denial of Service by memory exhaustion. This can be exploited by sending a specially crafted fra...

CVE-2018-1000518: Uncontrolled Resource Consumption

aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sendi...

Security Bulletin: Multiple vulnerabilities in IBM MessageSight (CVE-2014-0921, CVE-2014-0922, CVE-2014-0923, CVE-2014-0924)

Summary 3 security vulnerabilities have been identified in IBM MessageSight V1.0 and V1.1 allowing a remote attacker to perform a denial of service attack. A security vulnerability has been identified in IBM MessageSight V1.0 and V1.1 allowing an attacker to log in to the server over SSH using on...