CVE-2022-4899

Advisory

The python-zstd version 1.5.5.1 has upgraded its dependency Zstd from version 1.5.4 to 1.5.5. This upgrade includes a fix for a vulnerability discovered in zstd version 1.4.10. The vulnerability allows an attacker to supply an empty string as an argument to the command line tool, which could lead to a buffer overrun.
https://github.com/facebook/zstd/pull/3220/commits/e1873ad576cb478fff0e6e44ad99599cd5fd2846
https://github.com/sergey-dryabzhinsky/python-zstd/commit/4bf2a020aaa5055ff4a61fd11de3afe195b1c3d7

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/facebook/zstd/issues/3200
• https://bugzilla.redhat.com/show_bug.cgi?id=2179864
• https://access.redhat.com/security/cve/CVE-2022-4899
• https://nvd.nist.gov/vuln/detail/CVE-2022-4899
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4899