Sign in
Deutsch English Español Polski
Critical

An issue was discovered in py-lmdb 0.97. For certain values of md_flags, mdb_node_add does not properly set up a memcpy destination, leading to an invalid write operation. NOTE: this outcome occurs wh

  • Disclosed: 11.09.2019
  • Updated: 11.10.2026 12:20

An issue was discovered in py-lmdb 0.97. For certain values of md_flags, mdb_node_add does not properly set up a memcpy destination, leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) lmdb < 0.98 0.98

References

CVSS score 9.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-787
Platform
Python (PyPI)
Package
lmdb
Disclosed
11.09.2019
Updated
11.10.2026 12:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-9q62-r72g-pvv7 - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2019-236 - PyPA Advisory Database; CC BY 4.0

Vulnerability history: lmdb

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries
5
First → latest
09.2019 09.2019
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 3
  • High 2

Disclosures per year

  1. An issue was discovered in py-lmdb 0.97. There is a divide-by-zero error in the function mdb_env_open2 if mdb_env_read_header obtains a zero value for a certain size field. NOTE: this outcome occurs w
    High · 7.5 CVE-2019-16228 < 0.98 0.98
  2. An issue was discovered in py-lmdb 0.97. For certain values of mn_flags, mdb_cursor_set triggers a memcpy with an invalid write operation within mdb_xcursor_init1. NOTE: this outcome occurs when acces
    Critical · 9.8 CVE-2019-16227 < 0.98 0.98
  3. An issue was discovered in py-lmdb 0.97. For certain values of md_flags, mdb_node_add does not properly set up a memcpy destination, leading to an invalid write operation. NOTE: this outcome occurs wh this entry
    Critical · 9.8 CVE-2019-16224 < 0.98 0.98
  4. An issue was discovered in py-lmdb 0.97. For certain values of mp_flags, mdb_page_touch does not properly set up mc->mc_pg[mc->top], leading to an invalid write operation. NOTE: this outcome occurs wh
    Critical · 9.8 CVE-2019-16225 < 0.98 0.98
  5. An issue was discovered in py-lmdb 0.97. mdb_node_del does not validate a memmove in the case of an unexpected node->mn_hi, leading to an invalid write operation. NOTE: this outcome occurs when access
    High · 7.5 CVE-2019-16226 < 0.98 0.98

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.