CVE-2018-1000518: High severity websockets project websockets (python) vulnerability
aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in 5.
Other sources
The Python websockets library version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appears to be exploitable via sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in version 5.0
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-1000518.
What is the severity of CVE-2018-1000518?
The severity of CVE-2018-1000518 is high with a severity value of 7.5.
What is the affected software?
The affected software is the Python websockets library version 4 and Websockets Project Websockets 4.0.
How can this vulnerability be exploited?
This vulnerability can be exploited to cause a Denial of Service by memory exhaustion.
Is there a fix available for this vulnerability?
Yes, a fix is available with the remedy version 5.0 for the Python websockets library.