CVE-2019-16227

Vulnerability

In py-lmdb version 0.97, the function mdb_cursor_set can trigger a memcpy with an invalid write destination within mdb_xcursor_init1 when certain mn_flags values are used [1][2]. This constitutes a classic buffer overflow vulnerability in the LMDB binding's cursor handling logic.

Exploitation

An attacker can exploit this by supplying a specially crafted data.mdb file. When an application opens this malicious database and performs cursor operations, the overflow occurs [1][3]. No authentication is required; the attack vector is local file access or any scenario where the attacker can control the database file loaded by the application.

Impact

Successful exploitation can lead to memory corruption, potentially enabling denial of service or arbitrary code execution in the context of the application using py-lmdb [2][3]. The proof-of-concept code demonstrates the illegal memory write [3].

Mitigation

The vulnerability is present in py-lmdb 0.97. Users should upgrade to a patched version; the project's repository indicates ongoing maintenance and later versions likely address this issue [4]. No official workaround is documented beyond avoiding untrusted database files.