CVE-2021-44144: Heap-based Buffer Over-read in Croatia Control Asterix 2.8.1
Summary
CVE-2021-44144: Croatia Control Asterix 2.8.1 (python_v0.7.2) has a heap-based buffer over-read, with additional details to be disclosed at a later date. Affects asterix-decoder across 2 version ranges.
< 0.7.2
< 3f765d387d239ccc44e278a2ffa600fb6a6587f9
Fixed in 3f765d387d239ccc44e278a2ffa600fb6a6587f9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Croatia Control Asterix is a Python package (version 2.8.1) used for decoding Asterix data. Asterix is a binary data format commonly used in aviation surveillance systems. The package provides functionality to parse and extract information from Asterix messages. However, the package is vulnerable to a heap-based buffer over-read.
Vulnerability Detail
The vulnerability (CVE-2021-44144) in Croatia Control Asterix 2.8.1 allows an attacker to read beyond the boundaries of a heap-based buffer. This can lead to the exposure of sensitive information or a denial of service condition. The issue originates from a programming error in the package's code. The vulnerability was discovered on November 22, 2021, and its details were disclosed on January 5, 2022. The vulnerability affects the 'asterix-decoder' package on PyPI with versions up to 0.7.2.
How To Fix
Minimum fixed version
3f765d387d239ccc44e278a2ffa600fb6a6587f9
This is the first release that contains the fix.
pip install --upgrade "asterix-decoder==3f765d387d239ccc44e278a2ffa600fb6a6587f9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the package to the fixed version as soon as possible.
Conclusion
In conclusion, the Croatia Control Asterix 2.8.1 package is vulnerable to a heap-based buffer over-read (CVE-2021-44144). It is crucial to update the 'asterix-decoder' package to version 0.7.2 or later to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for asterix-decoder →
FAQ
Croatia Control Asterix is a Python package used for decoding Asterix data, which is a binary data format commonly used in aviation surveillance systems.
A heap-based buffer over-read occurs when a program reads data from a memory buffer beyond its allocated size in the heap. This can lead to the exposure of sensitive information or a denial of service condition.
The vulnerability was discovered through security research and analysis of the 'asterix-decoder' package.
The vulnerability could allow an attacker to read sensitive information from the memory of a vulnerable system or cause a denial of service by crashing the application.
Yes, a fix is available for this vulnerability. Users should update the 'asterix-decoder' package to version 0.7.2 or later.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
