CVE-2019-16227: py_lmdb Invalid write operation
Summary
CVE-2019-16227: py-lmdb Invalid write operation. Affects lmdb versions < 0.97. No fix is published. How to fix ↓
Also tracked for
- py-lmdb · Debian:11
The same CVE-2019-16227 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is lmdb, which is a Python wrapper for the Lightning Memory-Mapped Database (LMDB). LMDB is a high-performance, transactional key-value store that allows multiple concurrent readers and writers. It provides a simple and efficient way to manage large amounts of data. However, lmdb version 0.97 is vulnerable to an invalid write operation in certain scenarios.
Vulnerability Detail
The vulnerability in lmdb version 0.97 arises from a flaw in the mdb_cursor_set function, which triggers an invalid write operation within mdb_xcursor_init1 for specific values of mn_flags. This vulnerability can be exploited by an attacker who supplies a malicious data.mdb file. The consequence of this vulnerability is the potential for arbitrary code execution or denial of service. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to exercise caution when handling untrusted input and to implement proper input validation and sanitization techniques.
Conclusion
In conclusion, lmdb version 0.97 is vulnerable to an invalid write operation that can lead to arbitrary code execution or denial of service. It is crucial to upgrade to a non-affected version and validate input data to prevent exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lmdb →
FAQ
lmdb is a Python wrapper for the Lightning Memory-Mapped Database (LMDB), which is a high-performance, transactional key-value store.
This vulnerability can lead to arbitrary code execution or denial of service if an attacker supplies a malicious data.mdb file.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
To fix this vulnerability, upgrade to a version of lmdb that is not affected by this issue (higher than 0.97) and validate input data to prevent the use of malicious data.mdb files.
There is no specific workaround mentioned for this vulnerability. However, exercising caution when handling untrusted input and implementing proper input validation can help mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for lmdb.
