Resource exhaustion in websockets - CVE-2018-1000518

Vulnerability identifier: #VU77962

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1000518

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling compressed data. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

websockets
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
Public Cloud Module
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Server Applications Module
Basesystem Module
SUSE Package Hub 15
openSUSE Leap
Fedora
python3-opencensus-context
python3-opencensus-ext-threading
python3-grpcio-gcp
python2-grpcio-gcp
python3-aiocontextvars
python3-Automat
python3-opencensus
python3-pytest-asyncio
python3-knack
python3-Deprecated
python2-jsondiff
python3-jsondiff
python3-websocket-client
python3-opentelemetry-api
python3-googleapis-common-protos
python2-googleapis-common-protos
python3-avro
python3-google-api-core
grpc-debuginfo
grpc-debugsource
libgrpc8
libgrpc++1-debuginfo
libgrpc++1
python3-grpcio-debuginfo
grpc-devel-debuginfo
libgrpc8-debuginfo
python2-grpcio-debuginfo
python2-grpcio
grpc-devel
python3-grpcio
grpc-source
python3-PyGithub
azure-cli-core
python3-requests
python2-requests
python3-cryptography-vectors
python2-cryptography-vectors
python3-cryptography
python2-cryptography-debuginfo
python-cryptography-debuginfo
python-cryptography-debugsource
python2-cryptography
python3-cryptography-debuginfo
libprotoc20-32bit
python3-protobuf
protobuf-debugsource
libprotobuf-lite20-32bit
libprotobuf20
libprotoc20
protobuf-java
libprotobuf20-32bit
protobuf-devel-debuginfo
python2-protobuf
libprotobuf-lite20
libprotoc20-debuginfo
libprotobuf20-debuginfo
protobuf-devel
libprotobuf-lite20-debuginfo
protobuf-source
python3-pytest
python3-zope.interface-debuginfo
python-zope.interface-debuginfo
python-zope.interface-debugsource
python3-zope.interface
python-websockets
python-psutil-debuginfo
python2-psutil-debuginfo
python2-psutil
python-psutil-debugsource
python3-psutil
python3-psutil-debuginfo
python3-websockets
python-websockets-debugsource
python3-websockets-debuginfo
python3-humanfriendly
python2-humanfriendly
python3-constantly
python3-hyperlink
python3-incremental
python3-Twisted
python3-Twisted-debuginfo
PowerStore T
Dell EMC PowerStore Family Operating System

Install updates from vendor's website.

websockets - update to 5.0
python3-opencensus-context - update to 0.1.2-150100.3.3.3
python3-opencensus-ext-threading - update to 0.1.2-150100.3.3.3
python3-grpcio-gcp - update to 0.2.2-150100.3.3.3
python2-grpcio-gcp - update to 0.2.2-150100.3.3.3
python3-aiocontextvars - update to 0.2.2-150100.3.3.3
python3-Automat - update to 0.6.0-150000.3.4.1
python3-opencensus - update to 0.8.0-150100.3.3.3
python3-pytest-asyncio - update to 0.8.0-150100.3.3.3
python3-knack - update to 0.9.0-150100.3.7.3
python3-Deprecated - update to 1.2.13-150100.3.3.3
python2-jsondiff - update to 1.3.0-150100.3.6.3
python3-jsondiff - update to 1.3.0-150100.3.6.3
python3-websocket-client - update to 1.3.2-150100.6.7.3
python3-opentelemetry-api - update to 1.5.0-150100.3.3.3
python3-googleapis-common-protos - update to 1.6.0-150100.3.3.3
python2-googleapis-common-protos - update to 1.6.0-150100.3.3.3
python3-avro - update to 1.11.0-150100.3.3.3
python3-google-api-core - update to 1.14.2-150100.3.3.3
grpc-debuginfo - update to 1.25.0-150100.3.3.3
grpc-debugsource - update to 1.25.0-150100.3.3.3
libgrpc8 - update to 1.25.0-150100.3.3.3
libgrpc++1-debuginfo - update to 1.25.0-150100.3.3.3
libgrpc++1 - update to 1.25.0-150100.3.3.3
python3-grpcio-debuginfo - update to 1.25.0-150100.3.3.3
grpc-devel-debuginfo - update to 1.25.0-150100.3.3.3
libgrpc8-debuginfo - update to 1.25.0-150100.3.3.3
python2-grpcio-debuginfo - update to 1.25.0-150100.3.3.3
python2-grpcio - update to 1.25.0-150100.3.3.3
grpc-devel - update to 1.25.0-150100.3.3.3
python3-grpcio - update to 1.25.0-150100.3.3.3
grpc-source - update to 1.25.0-150100.3.3.3
python3-PyGithub - update to 1.43.5-150100.3.3.3
azure-cli-core - update to 2.17.1-150100.6.18.1
python3-requests - update to 2.25.1-150100.6.13.3
python2-requests - update to 2.25.1-150100.6.13.3
python3-cryptography-vectors - update to 3.3.2-150100.3.11.3
python2-cryptography-vectors - update to 3.3.2-150100.3.11.3
python3-cryptography - update to 3.3.2-150100.7.15.3
python2-cryptography-debuginfo - update to 3.3.2-150100.7.15.3
python-cryptography-debuginfo - update to 3.3.2-150100.7.15.3
python-cryptography-debugsource - update to 3.3.2-150100.7.15.3
python2-cryptography - update to 3.3.2-150100.7.15.3
python3-cryptography-debuginfo - update to 3.3.2-150100.7.15.3
PowerStore T - update to 3.6.1.2-2315284
libprotoc20-32bit - update to 3.9.2-150100.8.3.3
python3-protobuf - update to 3.9.2-150100.8.3.3
protobuf-debugsource - update to 3.9.2-150100.8.3.3
libprotobuf-lite20-32bit - update to 3.9.2-150100.8.3.3
libprotobuf20 - update to 3.9.2-150100.8.3.3
libprotoc20 - update to 3.9.2-150100.8.3.3
protobuf-java - update to 3.9.2-150100.8.3.3
libprotobuf20-32bit - update to 3.9.2-150100.8.3.3
protobuf-devel-debuginfo - update to 3.9.2-150100.8.3.3
python2-protobuf - update to 3.9.2-150100.8.3.3
libprotobuf-lite20 - update to 3.9.2-150100.8.3.3
libprotoc20-debuginfo - update to 3.9.2-150100.8.3.3
libprotobuf20-debuginfo - update to 3.9.2-150100.8.3.3
protobuf-devel - update to 3.9.2-150100.8.3.3
libprotobuf-lite20-debuginfo - update to 3.9.2-150100.8.3.3
protobuf-source - update to 3.9.2-150100.8.3.3
python3-pytest - update to 3.10.1-150000.7.5.1
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811
python3-zope.interface-debuginfo - update to 4.4.2-150000.3.4.1
python-zope.interface-debuginfo - update to 4.4.2-150000.3.4.1
python-zope.interface-debugsource - update to 4.4.2-150000.3.4.1
python3-zope.interface - update to 4.4.2-150000.3.4.1
python-websockets - update to 5.0.1-1.fc28
python-psutil-debuginfo - update to 5.9.1-150100.6.6.3
python2-psutil-debuginfo - update to 5.9.1-150100.6.6.3
python2-psutil - update to 5.9.1-150100.6.6.3
python-psutil-debugsource - update to 5.9.1-150100.6.6.3
python3-psutil - update to 5.9.1-150100.6.6.3
python3-psutil-debuginfo - update to 5.9.1-150100.6.6.3
python3-websockets - update to 9.1-150100.3.3.3
python-websockets-debugsource - update to 9.1-150100.3.3.3
python3-websockets-debuginfo - update to 9.1-150100.3.3.3
python3-humanfriendly - update to 10.0-150100.6.3.3
python2-humanfriendly - update to 10.0-150100.6.3.3
python3-constantly - update to 15.1.0-150000.3.4.1
python3-hyperlink - update to 17.2.1-150000.3.4.1
python3-incremental - update to 17.5.0-150000.3.4.1
python3-Twisted - update to 17.9.0-150000.3.8.1
python3-Twisted-debuginfo - update to 17.9.0-150000.3.8.1

• https://github.com/aaugustin/websockets/pull/407

• Denial of service in aaugustin websockets
• SUSE update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, pyt
• SUSE update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, pyt
• Multiple vulnerabilities in Dell PowerStore Family
• Multiple vulnerabilities in Dell PowerStoreT OS
• Fedora 28 update for python-websockets