# CVE-2019-16227: py-lmdb Invalid write operation

Source: https://junglewise.ai/threats/cve-2019-16227-py-lmdb-invalid-write-operation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-09-11  
License: CC BY 4.0 with a link back

CVE-2019-16227 · Severity: low · CVSS 3.1 · Published 2019-09-11

An issue was discovered in py-lmdb 0.97. For certain values of mn_flags, mdb_cursor_set triggers a memcpy with an invalid write operation within mdb_xcursor_init1. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.

Technologies: [lmdb (PyPI)](https://junglewise.ai/threats/technologies/lmdb). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2019-16227 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-16227 being exploited in the wild.

**How severe is CVE-2019-16227?** Low severity, with a CVSS score of 3.1, published 11 September 2019.

**Which products and versions are affected?** lmdb (PyPI) ECOSYSTEM:introduced=0,fixed=0.98, ECOSYSTEM:introduced=0,last_affected=0.97.

**Is there a fix for CVE-2019-16227?** Yes. lmdb (PyPI): upgrade to 0.98 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2019-16227?** Check whether you run lmdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lmdb (PyPI): upgrade to 0.98 or later

  ```sh
  pip install "lmdb>=0.98"
  ```


## Affected products

- lmdb (PyPI) ECOSYSTEM:introduced=0,fixed=0.98, ECOSYSTEM:introduced=0,last_affected=0.97

## Identifiers

- CVE-2019-16227
- GHSA-pf3p-v9xp-mrvf
- PYSEC-2019-239

## Related threats

- [LMDB invalid write](https://junglewise.ai/threats/cve-2019-16226-lmdb-invalid-write)
- [py-lmdb Invalid write operation](https://junglewise.ai/threats/cve-2019-16224-py-lmdb-invalid-write-operation)
- [py-lmdb Divide by Zero interruptions](https://junglewise.ai/threats/cve-2019-16228-py-lmdb-divide-by-zero-interruptions)
- [py-lmdb Invalid write operation](https://junglewise.ai/threats/cve-2019-16225-py-lmdb-invalid-write-operation)