Denial of Service Vulnerability in Scapy Package: Infinite Loop Issue
Summary
DEBIAN-CVE-2019-1010142: scapy 2.4.0 is affected by: Denial of Service. Affects scapy versions < 2.4.2-1. Fixed in 2.4.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Scapy is a powerful interactive packet manipulation tool written in Python. It allows users to create, send, and capture network packets, making it a valuable tool for network analysis and security testing. However, versions prior to 2.4.2-1 are vulnerable to a Denial of Service (DoS) attack due to an infinite loop in the _RADIUSAttrPacketListField.getfield method, which can lead to resource exhaustion and unresponsiveness.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2019-1010142 affects Scapy version 2.4.0 and earlier. It is caused by an infinite loop in the _RADIUSAttrPacketListField.getfield method, which can be triggered by sending crafted packets over the network or by using a pcap file. The consequences of this vulnerability include excessive resource consumption, leading to a denial of service where the application becomes unresponsive.
How To Fix
Minimum fixed version
2.4.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade scapyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted packets or pcap files that may exploit this vulnerability until the package is updated.
Conclusion
The Scapy package has a critical vulnerability that can lead to a denial of service due to an infinite loop in its code. Users are advised to update to the patched version to mitigate this risk. Additionally, using tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for scapy →
FAQ
The vulnerability can lead to an infinite loop, causing resource exhaustion and making the Scapy application unresponsive.
You can check your Scapy version by running 'scapy' in your terminal and looking for the version number. If it is 2.4.0 or earlier, it is affected.
Yes, the patch is available in version 2.4.2-1 and later of the Scapy package.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by using a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for scapy.
