CVE-2018-1000070 - CVE House
Back to Database
Status published High CVE-2018-1000070

Bitmessage PyBitmessage version v0.6.2 (and introduced in or after commit...

Vulnerability Description

Bitmessage PyBitmessage version v0.6.2 (and introduced in or after commit 8ce72d8d2d25973b7064b1cf76a6b0b3d62f0ba0) contains a Eval injection vulnerability in main program, file src/messagetypes/__init__.py function constructObject that can result in Code Execution. This attack appears to be exploitable via remote attacker using a malformed message which must be processed by the victim - e.g. arrive from any sender on bitmessage network. This vulnerability appears to have been fixed in v0.6.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-1000070

Credits & Attribution

No credits recorded in the NVD database.

References

More from bitmessage

View All →
CVE-2021-26917
PyBitmessage through 0.6.3.2 allows attackers to write screen captures to...
Medium 5.5

Affected Vendor

Affected Software

pybitmessage
Vulnerable Versions:
0.6.2

Timeline

Official Publish: March 13th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.