PyPI/aioxmpp CVE-2019-1000007: high 7.4, EPSS 1.17%

Depth counting error in guard() leading to multiple potential security issues in aioxmpp

Action: Upgrade aioxmpp to 0.10.3 or later.

pip install aioxmpp==0.10.3

Affected

Fixed versions

Sources

• osv: GHSA-6m9g-jr8c-cqw3
• https://github.com/horazont/aioxmpp/security/advisories/GHSA-6m9g-jr8c-cqw3
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000007
• https://github.com/horazont/aioxmpp/pull/268
• https://github.com/horazont/aioxmpp/commit/29ff0838a40f58efe30a4bbcea95aa8dab7da475
• https://github.com/horazont/aioxmpp/commit/f151f920f439d97d4103fc11057ed6dc34fe98be
• https://github.com/advisories/GHSA-6m9g-jr8c-cqw3
• https://github.com/horazont/aioxmpp
• https://github.com/pypa/advisory-database/tree/main/vulns/aioxmpp/PYSEC-2019-1.yaml

CVE-2019-1000007 · published 2020-04-29T17:12:39Z · modified 2024-09-04T20:04:41.882014Z · JSON