CVE-2017-1000001 FedMsg not properly completing message validation
Attackers can bypass message validation in FedMsg if it is explicitly configured to be enabled, potentially allowing malicious messages to be processed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-1000001?
CVE-2017-1000001 is a high-severity vulnerability in n/a, published on 13 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on.
Weakness: CWE-20
Which versions are affected by CVE-2017-1000001?
3 open source packages ship an affected version, including fedmsg and FedMsg. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fedmsg PyPI | All versions | 0.18.2 |
fedmsg PyPI | All versions | 0.18.2 |
FedMsg PyPI | All versions | 0.18.2 |
Products include Fedoraproject Fedmsg.
How do I fix CVE-2017-1000001?
Upgrade fedmsg to 0.18.2 or later.
Is CVE-2017-1000001 being exploited?
There is no known exploitation of CVE-2017-1000001 in the wild and no public exploit code.
Sources
Also known as GHSA-p7xc-35m8-57pr, PYSEC-2017-13, UBUNTU-CVE-2017-1000001.