CVE-2019-5039

An exploitable command execution vulnerability exists in the ASN1 certificate writing functionality of Openweave-core version 4.0.2. A specially crafted weave certificate can trigger a heap-based buffer overflow, resulting in code execution. An attacker can craft a weave certificate to trigger this vulnerability.

Score

CVSS 3.1 8.8 High

Status

Modified - talos-cna@cisco.com

Published

2019-08-20

Last modified

2024-08-04

Weaknesses

CWE-122, CWE-787

Affected products

• Openweave-core (Openweave)

References

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0802