Critical Vulnerability in cbor2 Package: Potential Service Crash Due to Malicious CBOR Input
Summary
DEBIAN-CVE-2024-26134: cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Affects cbor2 versions < 5.6.2-1. Fixed in 5.6.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cbor2 package provides encoding and decoding functionalities for the Concise Binary Object Representation (CBOR) serialization format, as defined in RFC 8949. It is widely used in applications that require efficient data serialization and deserialization. However, versions prior to 5.6.2 are vulnerable to a specific attack that can lead to service crashes when processing malformed CBOR data.
Vulnerability Detail
The vulnerability arises from a flaw in the cbor2 package, specifically in versions 5.5.1 through 5.6.1. An attacker can exploit this vulnerability by sending a specially crafted CBOR object that is excessively long, causing the service utilizing cbor2 to crash. This could lead to denial of service, impacting the availability of applications relying on this package. The issue has been addressed in version 5.6.2, which includes a patch to mitigate the risk.
How To Fix
Minimum fixed version
5.6.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade cbor2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to restrict the size of CBOR objects processed by your application. This can help mitigate the risk of service crashes until the package can be updated.
Conclusion
The cbor2 package has a critical vulnerability that can lead to service crashes when processing malicious CBOR data. It is essential to update to version 5.6.2 or later to mitigate this risk. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for cbor2 →
FAQ
cbor2 is a Python library that provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format, allowing efficient data serialization.
Versions 5.5.1 through 5.6.1 of the cbor2 package are affected by this vulnerability.
Exploiting this vulnerability can lead to a denial of service, causing applications that use cbor2 to crash when processing malicious CBOR data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Implement input validation to restrict the size of CBOR objects processed by your application as a temporary workaround until you can update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for cbor2.
