Approved changes feed: RSS · Atom
cpe:2.3:a:asynkronit:wire:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Asynkronit (f7e9ccd8-6a41-55f0-9594-4a89046c98ec) |
|---|---|
| Product | Wire (dfd823c3-f908-57f9-89ed-4ff32364fcf7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-29508 |
vulnerable | 2026-06-08 05:31:26.507764 |
Insecure deserialization in Wire
CRITICAL (9.1)
Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer. e.g. using a surrogate on the sender end, an attacker can pass information about a different type for the receiving end. And by doing so allowing the serializer to create any type on the deserializing end. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300?view=vs-2019. This also applies to the fork of Wire.
Published: 2021-05-11T16:35:10.000Z
Updated: 2024-08-03T22:11:05.408Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.