CVE-2020-15100: freewvs - Large File Denial of Service
Summary
CVE-2020-15100: In freewvs before 0.1.1, a user could create a large file that freewvs will try to read, which will terminate a scan process. This has been patched in 0.1.1. Affects freewvs across 2 version ranges.
< 0.1.1
< 18bbf2043e53f69e0119d24f8ae4edb274afb9b2
Fixed in 18bbf2043e53f69e0119d24f8ae4edb274afb9b2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
freewvs is a Python package available on PyPI that is used for web vulnerability scanning. It provides a set of tools and functionalities to scan web applications for security vulnerabilities. However, versions before 0.1.1 are vulnerable to a Denial of Service (DoS) attack caused by a flaw in the way the package handles large files during scanning.
Vulnerability Detail
The vulnerability (CVE-2020-15100) in freewvs allows an attacker to create a specially crafted large file that triggers a termination of the scan process. This can be exploited by an attacker to disrupt the scanning operation, leading to a DoS condition. The issue has been patched in version 0.1.1 of the package.
How To Fix
Minimum fixed version
18bbf2043e53f69e0119d24f8ae4edb274afb9b2
This is the first release that contains the fix.
pip install --upgrade "freewvs==18bbf2043e53f69e0119d24f8ae4edb274afb9b2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in freewvs (CVE-2020-15100) allows an attacker to disrupt the scanning process by creating a large file. It is recommended to update to version 0.1.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for freewvs →
FAQ
This vulnerability allows an attacker to disrupt the scanning process of freewvs, leading to a DoS condition. However, it does not provide direct access to sensitive information or allow remote code execution.
No, only versions before 0.1.1 are affected. It is recommended to update to the latest version to mitigate the vulnerability.
No, there is no known workaround for this vulnerability. It is necessary to update to the patched version of freewvs.
There is no information available regarding active exploitation of this vulnerability in the wild.
You can find more information about this vulnerability in the freewvs advisory database: [link to advisory database]
References
Related vulnerabilities
Recent vulnerabilities recorded for freewvs.
