CVE-2019-1010142: Denial of Service in scapy 2.4.0
Summary
CVE-2019-1010142: scapy 2.4.0 is affected by: Denial of Service. Affects scapy versions < 2.4.1. Fixed in 2.4.1. How to fix ↓
Also tracked for
- scapy · Debian:11
The same CVE-2019-1010142 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Scapy is a powerful interactive packet manipulation program written in Python. It allows users to send, sniff, dissect, and forge network packets. The vulnerability affects version 2.4.0 of scapy. The component affected is _RADIUSAttrPacketListField.getfield(self..). The vulnerability can be exploited over the network or in a pcap file, leading to an infinite loop, resource consumption, and program unresponsiveness.
Vulnerability Detail
The vulnerability in scapy 2.4.0 allows an attacker to trigger an infinite loop, causing resource exhaustion and making the program unresponsive. This can be exploited remotely over the network or by using a pcap file. The specific component affected is _RADIUSAttrPacketListField.getfield(self..). The impact of this vulnerability can result in denial of service, disrupting the normal operation of the affected system.
How To Fix
Minimum fixed version
2.4.1
This is the first release that contains the fix.
pip install --upgrade "scapy==2.4.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to a patched version of scapy.
Conclusion
The vulnerability in scapy 2.4.0 allows for a denial of service attack, causing the affected program to become unresponsive and consume excessive resources. It is crucial to upgrade to version 2.4.1 or later of scapy to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for scapy →
FAQ
The vulnerability can lead to denial of service, causing the affected program to become unresponsive and consume excessive resources.
The vulnerability can be exploited remotely over the network or by using a pcap file.
Version 2.4.0 of scapy is affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to a patched version of scapy.
You can update your scapy installation by running the following command: pip install --upgrade scapy.
Related vulnerabilities
Recent vulnerabilities recorded for scapy.
