HIGH7.5
PYSEC-2023-190
Quick fix
PYSEC-2023-190 — asyncua: upgrade to the fixed version with the command below.
pip install --upgrade 'asyncua>=f6603daa34a93a658f0e176cb0b9ee5a6643b262'Details
Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/asyncua
Introduced in:
0Fixed in: f6603daa34a93a658f0e176cb0b9ee5a6643b262Fix
pip install --upgrade 'asyncua>=f6603daa34a93a658f0e176cb0b9ee5a6643b262'References
- https://gist.github.com/artfire52/1540b234350795e0ecb4d672608dbec8[EVIDENCE]
- https://gist.github.com/artfire52/1540b234350795e0ecb4d672608dbec8[WEB]
- https://github.com/FreeOpcUa/opcua-asyncio/releases/tag/v0.9.96[WEB]
- https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673709[EVIDENCE]
- https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673709[FIX]
- https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673709[WEB]
- https://github.com/FreeOpcUa/opcua-asyncio/issues/1013[EVIDENCE]
- https://github.com/FreeOpcUa/opcua-asyncio/issues/1013[REPORT]
- https://github.com/FreeOpcUa/opcua-asyncio/pull/1039[FIX]
- https://github.com/FreeOpcUa/opcua-asyncio/commit/f6603daa34a93a658f0e176cb0b9ee5a6643b262[FIX]
- https://github.com/advisories/GHSA-gfvq-mxw3-mfq3[ADVISORY]