CVE-2018-1000518

CVE	CVE-2018-1000518
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2018-06-26 16:29:00 UTC
Updated	2022-02-10 20:10:00 UTC
Description	aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in 5.

Problem Types: CWE-400

Type	Vendor	Product	Version	Update	Edition	Language
Application	Myks	Websockets	4.0	All	All	All
Application	Myks	Websockets	4.0	All	All	All
Application	Websockets Project	Websockets	4.0	All	All	All
Application	Websockets Project	Websockets	4.0	All	All	All

Reference	Source	Link	Tags
Security fix: defend against zip bombs. by aaugustin · Pull Request #407 · aaugustin/websockets · GitHub	MISC	github.com	Exploit, Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

754157 SUSE Enterprise Linux Security Update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, pyt (SUSE-SU-2023:2783-1)
754878 SUSE Enterprise Linux Security Update for grpc, protobuf, python-DEPRECATED, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, pyt (SUSE-SU-2023:2783-2)
981271 Python (pip) Security Update for websockets (GHSA-6g87-ff9q-v847)