CVE-2022-1930: ReDoS in eth-account encode_structured_data function
Published Aug 22, 2022
·Updated
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encodestructureddata method
Affected Software
1 affected component
Ethereum Eth-account Python<0.5.9
Event History
Aug 22, 2022
CVE Published
via MITRE·06:15 PM
Data Sourced
via MITRE·06:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2022-1930?
CVE-2022-1930 is a vulnerability that allows an attacker to trigger an exponential ReDoS (Regular Expression Denial of Service) in the eth-account PyPI package.
2
How does CVE-2022-1930 work?
CVE-2022-1930 can be triggered when an attacker is able to supply arbitrary input to the encode_structured_data method in the eth-account PyPI package.
3
What is the severity of CVE-2022-1930?
CVE-2022-1930 has a severity rating of 7.5 (high).
4
Which software is affected by CVE-2022-1930?
The eth-account PyPI package up to version 0.5.9 is affected by CVE-2022-1930.
5
How can I fix CVE-2022-1930?
To fix CVE-2022-1930, it is recommended to update the eth-account PyPI package to a version that is not affected.