CVE-2024-26134
cbor2 can crash from long CBOR objects. Fixed in 5.6.2.
- CVSS 7.5
- CWE-120
- Resource Management
- Remote
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.
- CWE
- CWE-120
- CVSS base score
- 7.5
- Published
- 2024-02-19
- OWASP
- A03 Injection
- Orthogonal defect classification
- Algorithm
- Code defect classification
- Incorrect Algorithm
- Category
- Resource Management
- Subcategory
- Insecure Parsing or Deserialization
- Accessibility scope
- Remote
- Impact
- Denial of Service (DoS)
- Affected component
- cbor2
- Fixed by upgrading
- Yes
Solution
Upgrade to version 5.6.2.
Vulnerable code sample
import cbor2
def decode(data):
try:
decoded_data = cbor2.loads(data)
return decoded_data
except Exception as e:
print(f"Error decoding data: {e}")
return None
if __name__ == '__main__':
try:
large_string_data = cbor2.dumps({"key": "A" * (1024 * 1024 * 10)})
decoded_data = decode(large_string_data)
print("Decoded data with limits:", decoded_data)
except ValueError as e:
print("Error decoding large string:", e)Patched code sample
import cbor2
def decode(data, max_size=1024 * 1024):
try:
if len(data) > max_size * 2:
raise ValueError("CBOR data size exceeds the maximum allowed size.")
decoded_object = cbor2.loads(data)
if len(str(decoded_object)) > max_size:
raise ValueError("Decoded object exceeds the maximum allowed size.")
return decoded_object
except cbor2.CBORDecodeError as e:
raise cbor2.CBORDecodeError(f"Error Decoding CBOR data: {e}")
except Exception as e:
raise ValueError(f"Error during decoding, possible data corruption: {e}")
if __name__ == '__main__':
try:
large_string_data = cbor2.dumps({"key": "A" * (1024 * 1024 * 10)})
decoded_data = decode(large_string_data)
print("Decoded data with limits:", decoded_data)
except ValueError as e:
print("Error decoding large string:", e)Payload
\xfb\xff\xff\xff\xff\xff\xff\xff\xfeCite this entry
@misc{vaitp:cve202426134,
title = {{cbor2 can crash from long CBOR objects. Fixed in 5.6.2.
}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2024},
note = {VAITP Python Vulnerability Dataset, entry CVE-2024-26134},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-26134/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::