CVE-2022-24902 Memory issue in playing videos
Uncontrolled memory consumption in the TkVideoplayer library can lead to performance degradation and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24902?
CVE-2022-24902 is a low-severity denial of service vulnerability in PaulleDemon tkVideoPlayer, published on 5 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
TkVideoplayer is a simple library to play video files in tkinter. Uncontrolled memory consumption in versions of TKVideoplayer prior to 2.0.0 can theoretically lead to performance degradation. There are no known workarounds. This issue has been patched and users are advised to upgrade to version 2.0.0 or later.
Weakness: CWE-400
Which versions are affected by CVE-2022-24902?
3 open source packages ship an affected version, including tkvideoplayer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tkvideoplayer PyPI | All versions | 2.0.0 |
tkvideoplayer PyPI | All versions | 2.0.0 |
tkvideoplayer PyPI | All versions | 2.0.0 |
Products include Python Tkvideoplayer.
How do I fix CVE-2022-24902?
Upgrade tkvideoplayer to 2.0.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-24902 being exploited?
There is no known exploitation of CVE-2022-24902 in the wild and no public exploit code.
Sources
Also known as GHSA-jmhj-vh4q-hhmq, PYSEC-2022-187.