CVE-2018-12680: CoAPthon - Denial of Service Vulnerability
Summary
CVE-2018-12680: CoAPthon DoS due to Exceptions. Affects coapthon versions < 4.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CoAPthon is a Python library that provides an implementation of the Constrained Application Protocol (CoAP), a lightweight protocol designed for resource-constrained devices and networks. It allows applications to communicate over the Internet of Things (IoT) using the CoAP protocol. CoAPthon is widely used in various applications, including CoAP servers, clients, reverse proxies, and example collect CoAP servers and clients.
Vulnerability Detail
The Serialize.deserialize() method in CoAPthon versions 3.1, 4.0.0, 4.0.1, and 4.0.2 mishandles certain exceptions, which can be exploited to cause a denial of service. When applications that use this library receive crafted CoAP messages, they can be overwhelmed and rendered unresponsive. This vulnerability poses a high risk to the availability of affected applications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version of CoAPthon to mitigate the risk of a denial of service attack.
Conclusion
The CoAPthon library is vulnerable to a denial of service attack due to mishandling of exceptions in the Serialize.deserialize() method. To mitigate this risk, it is crucial to update to CoAPthon version 4.0.3 or later. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for coapthon →
FAQ
CoAPthon is a Python library that implements the Constrained Application Protocol (CoAP), enabling communication over the Internet of Things (IoT) using lightweight protocols.
CoAPthon versions 3.1, 4.0.0, 4.0.1, and 4.0.2 are affected by this vulnerability.
This vulnerability can lead to a denial of service in applications that use CoAPthon, rendering them unresponsive when receiving crafted CoAP messages.
To fix this vulnerability, update CoAPthon to version 4.0.3 or later, which includes the necessary patches.
No, there is no known workaround for this vulnerability. Updating to the patched version is the recommended solution.
