CVE-2019-16226
HighSummary
An issue was discovered in py-lmdb 0.97 where mdb_node_del does not validate a memmove in the case of an unexpected node->mn_hi, leading to an invalid write operation. This occurs when accessing a data.mdb file supplied by an attacker.
Risk Assessment
An attacker can supply a crafted data.mdb file that, when processed by an application using py-lmdb, may cause an invalid memory write, potentially leading to a crash or further privilege escalation.
Recommendation
Update py-lmdb to a version newer than 0.97 where this vulnerability is fixed. If an update is not possible, avoid processing data.mdb files from untrusted sources.
Other vulnerabilities in py-lmdb
See all- CVE-2019-16228High
A divide-by-zero error was discovered in py-lmdb 0.97 in the mdb_env_open2 function when mdb_env_read_header obtains a zero value for a certain size field. This issue can be triggered by supplying a crafted data.mdb file.
- CVE-2019-16224Critical
An issue was discovered in py-lmdb 0.97 where for certain values of md_flags, mdb_node_add does not properly set up a memcpy destination, leading to an invalid write operation. This occurs when accessing a data.mdb file supplied by an attacker.
- CVE-2019-16225Critical
An issue was discovered in py-lmdb 0.97 where mdb_page_touch does not properly set up mc->mc_pg[mc->top] for certain mp_flags values, leading to an invalid write operation. The vulnerability can be triggered by supplying a crafted data.mdb file.
- CVE-2019-16227Critical
An issue was discovered in py-lmdb 0.97 where for certain values of mn_flags, mdb_cursor_set triggers a memcpy with an invalid write operation within mdb_xcursor_init1. This occurs when accessing a data.mdb file supplied by an attacker.
Original NVD description (English source)
An issue was discovered in py-lmdb 0.97. mdb_node_del does not validate a memmove in the case of an unexpected node->mn_hi, leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.