PyPI/bsdiff4 CVE-2020-15904: high 7.8, EPSS 1.05%
A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file.
Action: Upgrade bsdiff4 to 1.2.0 or later.
pip install bsdiff4==1.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.2.0 | - |
Fixed versions
| 1.2.0 |
Sources
- osv: PYSEC-2020-30
- nvd: CVE-2020-15904
- https://github.com/ilanschnell/bsdiff4/commit/49a4cee2feef7deaf9d89e5e793a8824930284d7
- https://github.com/ilanschnell/bsdiff4/blob/master/CHANGELOG.txt
- https://github.com/advisories/GHSA-f8m3-jpxr-hm5x
CVE-2020-15904 · published · modified · JSON