CVE-2022-1930

Advisory

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encode_structured_data method

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-v65g-f3cj-fjp4
• https://nvd.nist.gov/vuln/detail/CVE-2022-1930
• https://github.com/ethereum/eth-account/commit/70f89be700df0d5f08ef696252c88741f8414060
• https://github.com/ethereum/eth-account
• https://research.jfrog.com/vulnerabilities/eth-account-redos-xray-248681/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1930