CVE-2021-40839 | Vulnetix

CVE-2021-40839 PUBLISHED CVSS 8.699999809265137 HIGH

The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.

EPSS 5.52% · 92.8th percentile

Risk Scores

CVSS 4.0

8.699999809265137

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS Score

5.52%

92.8th percentile

Affected Products

Vendor	Product	Versions
PyPI	rencode	0
rencode_project	rencode	0
fedoraproject	fedora	34, 35
n/a	n/a	n/a

Timeline

Sep 10, 2021 EPSS Score
Sep 10, 2021 CVE Published
Dec 14, 2021 EPSS Score
Jan 4, 2022 EPSS Score
Feb 15, 2022 EPSS Score
Mar 3, 2022 EPSS Score
Jun 27, 2022 EPSS Score
Aug 25, 2022 EPSS Score
Dec 18, 2022 EPSS Score
Feb 14, 2023 EPSS Score
Apr 13, 2023 EPSS Score
Jun 10, 2023 EPSS Score

References

https://github.com/aresch/rencode/pull/29 fix
https://github.com/aresch/rencode/commit/572ff74586d9b1daab904c6f7f7009ce0143bb75 fix
https://seclists.org/fulldisclosure/2021/Sep/16 url
https://pypi.org/project/rencode/#history url
https://security.netapp.com/advisory/ntap-20211008-0001/ url
FEDORA-2022-02340931ec vendor-advisory
FEDORA-2022-1033a2718b vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-40839 advisory
https://github.com/advisories/GHSA-gh8j-2pgf-x458 advisory
https://github.com/aresch/rencode package
https://github.com/pypa/advisory-database/tree/main/vulns/rencode/PYSEC-2021-345.yaml url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BMVQRPDVSVZNGGX57CFKCYT3DEYO4QB6 url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MCLETLGVM5DBX6QNHQFW6TWGO5T3DENY url
https://security.netapp.com/advisory/ntap-20211008-0001 url

Open in Interactive Console →