GHSA-4r4c-66gf-g9g5

Source

https://github.com/advisories/GHSA-4r4c-66gf-g9g5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-4r4c-66gf-g9g5/GHSA-4r4c-66gf-g9g5.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-4r4c-66gf-g9g5

Aliases

CVE-2022-4969

Published

2024-05-28T21:22:45Z

Modified

2024-05-28T21:42:21.386947Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

rockhopper Buffer Overflow vulnerability

Details

A vulnerability, which was classified as critical, has been found in bwoodsend rockhopper up to 0.1.2. Affected by this issue is the function count_rows of the file rockhopper/src/ragged_array.c of the component Binary Parser. The manipulation of the argument raw leads to buffer overflow. Local access is required to approach this attack. Upgrading to version 0.2.0 is able to address this issue. The name of the patch is 1a15fad5e06ae693eb9b8908363d2c8ef455104e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-266312.

Database specific

{
    "nvd_published_at": "2024-05-27T17:15:09Z",
    "cwe_ids": [
        "CWE-120"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-28T21:22:45Z"
}

References

Affected packages

PyPI / rockhopper

Package

Name: rockhopper; View open source insights on deps.dev
Purl: pkg:pypi/rockhopper

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.2.0

Affected versions

0.*

0.1.0

0.1.1

0.1.2

Database specific

{
    "last_known_affected_version_range": "<= 0.1.2"
}