Encoding Error Affecting armadito/armadito-av package, versions [0,]


Severity

Recommended
0.0
low
0
10

CVSS assessment by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of Concept
EPSS
1.72% (77th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UNMANAGED-ARMADITOARMADITOAV-2367469
  • published26 Jan 2022
  • disclosed21 Feb 2018
  • creditUnknown

Introduced: 21 Feb 2018

CVE-2018-7289  (opens in a new tab)
CWE-172  (opens in a new tab)

How to fix?

There is no fixed version for armadito/armadito-av.

Overview

Affected versions of this package are vulnerable to Encoding Error. An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames containing pure UTF-16 characters can bypass detection. The user-mode service will fail to open the file for scanning after the conversion is done from Unicode to ANSI. This happens because characters that cannot be converted from Unicode are replaced with '?' characters.

CVSS Base Scores

version 3.1