What is the CVSS score of CVE-2019-16764?

CVE-2019-16764 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.1%.

Is there a patch available for CVE-2019-16764?

Yes, a patch is available for CVE-2019-16764. Update the affected software to the latest version immediately.

Powassent CVE-2019-16764

Q: Which versions of Powassent are affected by CVE-2019-16764?

The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.. A patch is available.

MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2019-11-25 security-advisories@github.com

Denial Of Service Powassent

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Nov 25, 2019 - 17:15 nvd

MEDIUM 5.5

DescriptionNVD

The use of String.to_atom/1 in PowAssent is susceptible to denial of service attacks. In PowAssent.Phoenix.AuthorizationController a value is fetched from the user provided params, and String.to_atom/1 is used to convert the binary value to an atom so it can be used to fetch the provider configuration value. This is unsafe as it is user provided data, and can be used to fill up the whole atom table of ~1M which will cause the app to crash.

AnalysisAI

The use of String.to_atom/1 in PowAssent is susceptible to denial of service attacks. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Technical ContextAI

This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400), which allows attackers to cause denial of service by exhausting system resources. The use of String.to_atom/1 in PowAssent is susceptible to denial of service attacks. In PowAssent.Phoenix.AuthorizationController a value is fetched from the user provided params, and String.to_atom/1 is used to convert the binary value to an atom so it can be used to fetch the provider configuration value. This is unsafe as it is user provided data, and can be used to fill up the whole atom table of ~1M which will cause the app to crash. Affected products include: Powauth Powassent.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Implement rate limiting, set resource quotas, validate input sizes, use timeouts.