http://bugzilla.opensuse.org/show_bug.cgi?id=1099269 Bug ID: 1099269 Summary: VUL-0: CVE-2018-1000518: python-websockets: Improper Handling of Highly Compressed Data Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other URL: https://smash.suse.de/issue/208939/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team@suse.de Reporter: abergmann@suse.com QA Contact: security-team@suse.de Found By: Security Response Team Blocker: --- CVE-2018-1000518 aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in 5. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000518 https://github.com/aaugustin/websockets/pull/407 -- You are receiving this mail because: You are on the CC list for the bug.