CVE-2018-12680: CoAPthon Library Denial of Service Vulnerability
Summary
CVE-2018-12680: The Serialize.deserialize() method in CoAPthon 3.1, 4.0.0, 4.0.1, and 4.0.2 mishandles certain exceptions, leading to a denial of service in applications that use this library (e.g., the standard CoAP server, CoAP client... Affects coapthon versions >= 3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
CoAPthon is a Python library that provides support for the Constrained Application Protocol (CoAP), a specialized web transfer protocol for constrained devices and networks. It allows developers to create CoAP servers, clients, reverse proxies, and other related applications. The library is commonly used in IoT (Internet of Things) projects and applications. However, versions 3.1 to 4.0.2 of CoAPthon are vulnerable to a denial of service (DoS) attack when handling certain exceptions in the Serialize.deserialize() method. This vulnerability can be exploited by sending crafted CoAP messages, leading to a disruption of service in affected applications.
Vulnerability Detail
The vulnerability in CoAPthon arises from mishandling certain exceptions in the Serialize.deserialize() method. When an application using the library receives a specially crafted CoAP message, the mishandling of exceptions can result in a denial of service. This can impact various components built with CoAPthon, such as the standard CoAP server, CoAP client, CoAP reverse proxy, and example collect CoAP server and client. The vulnerability can be exploited remotely by an attacker without requiring any authentication.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the CoAPthon library to the patched version to mitigate the risk of a denial of service attack.
Conclusion
The CoAPthon library versions 3.1 to 4.0.2 are vulnerable to a denial of service (DoS) attack due to mishandling of exceptions in the Serialize.deserialize() method. To address this vulnerability, it is recommended to update the library to version 4.0.3 or later. Users should upgrade their dependencies and ensure they are using the patched version to prevent potential disruptions in their CoAP applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for coapthon →
FAQ
CoAPthon is a Python library that provides support for the Constrained Application Protocol (CoAP), a specialized web transfer protocol for constrained devices and networks. It allows developers to create CoAP servers, clients, reverse proxies, and other related applications.
The vulnerability in CoAPthon can lead to a denial of service (DoS) attack in applications that use the library. This can result in a disruption of service, rendering the affected components unresponsive.
The vulnerability can be exploited by sending crafted CoAP messages to applications that use the CoAPthon library. By mishandling certain exceptions, the library can be forced into a state of unresponsiveness, causing a denial of service.
No, authentication is not required to exploit this vulnerability. An attacker can remotely exploit the vulnerability without any authentication.
No, there is no known workaround for this vulnerability. It is crucial to update the CoAPthon library to the patched version to mitigate the risk of a denial of service attack.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
