GHSA-vh3x-525m-jp4r

Suggest an improvement
Source
https://github.com/advisories/GHSA-vh3x-525m-jp4r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-vh3x-525m-jp4r/GHSA-vh3x-525m-jp4r.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vh3x-525m-jp4r
Aliases
Published
2024-09-17T21:30:32Z
Modified
2024-09-24T18:12:01.431387Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
heap-buffer-overflow in MicroPython
Details

A vulnerability was found in MicroPython 1.23.0. It has been rated as critical. Affected by this issue is the function mpzasbytes of the file py/objint.c. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 908ab1ceca15ee6fd0ef82ca4cba770a3ec41894. It is recommended to apply a patch to fix this issue. In micropython objint component, converting zero from int to bytes leads to heap buffer-overflow-write at mpzasbytes.

References

Affected packages

PyPI / micropython-copy

Package

Name
micropython-copy
View open source insights on deps.dev
Purl
pkg:pypi/micropython-copy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
3.3.3.post3

Affected versions

0.*

0.0.1
0.0.2

3.*

3.3.3-2
3.3.3.post3

PyPI / micropython-io

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
0.1

Affected versions

0.*

0.0.1
0.0.2
0.0.3
0.1

PyPI / micropython-os

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
0.8

Affected versions

0.*

0.2.3
0.2.4
0.3
0.3.1
0.4.1
0.4.2
0.4.3
0.4.4
0.6
0.7
0.7.1
0.8