Action not permitted
Modal body text goes here.
cve-2020-24341
Vulnerability from cvelistv5
Published
2020-12-11 22:55
Modified
2024-08-04 15:12
Severity ?
EPSS score ?
Summary
An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Service or an information leak.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 | Third Party Advisory, US Government Resource | |
| cve@mitre.org | https://www.kb.cert.org/vuls/id/815128 | Third Party Advisory, US Government Resource |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:12:08.661Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.kb.cert.org/vuls/id/815128"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2020-12-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Service or an information leak."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-11T22:55:33",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.kb.cert.org/vuls/id/815128"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-24341",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Service or an information leak."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.kb.cert.org/vuls/id/815128",
"refsource": "MISC",
"url": "https://www.kb.cert.org/vuls/id/815128"
},
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-24341",
"datePublished": "2020-12-11T22:55:33",
"dateReserved": "2020-08-13T00:00:00",
"dateUpdated": "2024-08-04T15:12:08.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2020-24341\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2020-12-11T23:15:14.153\",\"lastModified\":\"2020-12-14T21:26:46.237\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Service or an information leak.\"},{\"lang\":\"es\",\"value\":\"Se detect\u00f3 un problema en picoTCP y picoTCP-NG versiones hasta 1.7.0.\u0026#xa0;La funci\u00f3n de procesamiento de datos de entrada TCP en el archivo pico_tcp.c no comprueba la longitud de los paquetes TCP entrantes, lo que conlleva a una lectura fuera de l\u00edmites al ensamblar los paquetes recibidos en un segmento de datos, eventualmente causando una Denegaci\u00f3n de Servicio o un filtrado de informaci\u00f3n\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":6.4},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:altran:picotcp:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.7.0\",\"matchCriteriaId\":\"BEB4123E-EE54-4991-9011-42FD1FC83662\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:altran:picotcp-ng:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.7.0\",\"matchCriteriaId\":\"40699721-5367-45CB-880E-B7E0F3C15BF3\"}]}]}],\"references\":[{\"url\":\"https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.kb.cert.org/vuls/id/815128\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]}]}}"
}
}
ghsa-qj3c-vm3g-g389
Vulnerability from github
Published
2022-05-24 17:36
Modified
2022-05-24 17:36
Details
An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Service or an information leak.
{
"affected": [],
"aliases": [
"CVE-2020-24341"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-11T23:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Service or an information leak.",
"id": "GHSA-qj3c-vm3g-g389",
"modified": "2022-05-24T17:36:11Z",
"published": "2022-05-24T17:36:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24341"
},
{
"type": "WEB",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/815128"
}
],
"schema_version": "1.4.0",
"severity": []
}
icsa-20-343-01
Vulnerability from csaf_cisa
Published
2020-12-08 00:00
Modified
2020-12-08 00:00
Summary
Multiple Embedded TCP/IP Stacks
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
Successful exploitation of these vulnerabilities could allow attackers to corrupt memory, put devices into infinite loops, access unauthorized data, and/or poison DNS cache.
Critical infrastructure sectors
Multiple
Countries/areas deployed
Worldwide
Company headquarters location
Various
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
Exploitability
No known public exploits specifically target these vulnerabilities.
{
"document": {
"acknowledgments": [
{
"names": [
"Daniel dos Santos",
"Stanislav Dashevskyi",
"Jos Wetzels",
"Amine Amri"
],
"organization": "Forescout Research Labs",
"summary": "reporting these vulnerabilities to CISA"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "Successful exploitation of these vulnerabilities could allow attackers to corrupt memory, put devices into infinite loops, access unauthorized data, and/or poison DNS cache.",
"title": "Risk evaluation"
},
{
"category": "other",
"text": "Multiple",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Various",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
},
{
"category": "other",
"text": "No known public exploits specifically target these vulnerabilities.",
"title": "Exploitability"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-20-343-01 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2020/icsa-20-343-01.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-20-343-01 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-20-343-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Multiple Embedded TCP/IP Stacks",
"tracking": {
"current_release_date": "2020-12-08T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-20-343-01",
"initial_release_date": "2020-12-08T00:00:00.000000Z",
"revision_history": [
{
"date": "2020-12-08T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-20-343-01 Multiple Embedded TCP-IP Stacks"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c= 1.0",
"product": {
"name": "uIP (EOL): Version 1.0 and prior",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "uIP (EOL)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c= 4.5",
"product": {
"name": "uIP-Contiki-NG: Version 4.5 and prior",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "uIP-Contiki-NG"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c= 5.1",
"product": {
"name": "Nut/Net: Version 5.1 and prior",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "Nut/Net"
},
{
"branches": [
{
"category": "product_version",
"name": "4.6.3",
"product": {
"name": "FNET: Version 4.6.3",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "FNET"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c= 2.1.12",
"product": {
"name": "open-iscsi: Version 2.1.12 and prior",
"product_id": "CSAFPID-0005"
}
}
],
"category": "product_name",
"name": "open-iscsi"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c= 1.7.0",
"product": {
"name": "picoTCP (EOL): Version 1.7.0 and prior",
"product_id": "CSAFPID-0006"
}
}
],
"category": "product_name",
"name": "picoTCP (EOL)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c= 3.0",
"product": {
"name": "uIP-Contiki-OS (end-of-life [EOL]): Version 3.0 and prior",
"product_id": "CSAFPID-0007"
}
}
],
"category": "product_name",
"name": "uIP-Contiki-OS (end-of-life [EOL])"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c= 1.7.0",
"product": {
"name": "picoTCP-NG: Version 1.7.0 and prior",
"product_id": "CSAFPID-0008"
}
}
],
"category": "product_name",
"name": "picoTCP-NG"
}
],
"category": "vendor",
"name": "multiple open source"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-13984",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The function used in uIP-Contiki-OS to process IPv6 extension headers and extension header options can be forced into an infinite loop state due to unchecked header/option lengths.CVE-2020-13984 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13984"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-13985",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "The function used in uIP-Contiki-OS to decapsulate RPL extension headers does not check for unsafe integer conversion when parsing the values provided in a header, allowing an attacker to corrupt memory.CVE-2020-13985 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13985"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-13986",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The function used in uIP-Contiki-OS to decapsulate RPL extension headers does not check the length value of an RPL extension header received, allowing an attacker to cause it to enter an infinite loop.CVE-2020-13986 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13986"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-13987",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The function in open-iscsi, uIP-Contiki-OS, and uIP that parses incoming transport layer packets (TCP/UDP) does not check the length fields of packet headers against the data available in the packets. Given arbitrary lengths, an out-of-bounds memory read may be performed during the checksum computation.CVE-2020-13987 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13987"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-13988",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "The function in open-iscsi, uIP-Contiki-OS, and uIP that parses the TCP MSS option does not check the validity of the length field of this option, allowing an attacker to force it into an infinite loop when arbitrary TCP MSS values are supplied.CVE-2020-13988 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13988"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-17437",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "When handling TCP urgent data in open-iscsi, uIP-Contiki-OS, and uIP, there are no sanity checks for the value of the urgent data pointer, allowing an attacker to corrupt memory by supplying arbitrary urgent data pointer offsets within TCP packets.CVE-2020-17437 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17437"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-17438",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The function in open-iscsi and uIP that reassembles fragmented packets does not validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. This could lead to memory corruption.CVE-2020-17438 has been assigned to this vulnerability. A CVSS v3 base score of 7.0 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17438"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-17439",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Incoming DNS replies in uIP are parsed by the DNS client even if there were no outgoing queries. The DNS transaction ID is not sufficiently random. Provided that the DNS cache is quite small (four entries), this facilitates DNS cache poisoning attacks.CVE-2020-17439 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17439"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-17440",
"cwe": {
"id": "CWE-170",
"name": "Improper Null Termination"
},
"notes": [
{
"category": "summary",
"text": "When parsing incoming DNS packets in uIP-Contiki-NG, uIP-Contiki-OS, and uIP, there are no checks whether domain names are null-terminated. This allows an attacker to achieve memory corruption with crafted DNS responses.CVE-2020-17440 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17440"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-17441",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In picoTCP-NG and picoTCP the payload length field of IPv6 extension headers are not checked against the data available in incoming packets, allowing an attacker to corrupt memory.CVE-2020-17441 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17441"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-17442",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "The function in picoTCP-NG and picoTCP that processes the hop-by-hop extension header in IPv6 packets and its options lacks any checks against the length field of the header, allowing an attacker to cause the function to enter an infinite loop by supplying arbitrary length values.CVE-2020-17442 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17442"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-17443",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "When processing ICMPv6 echo requests in picoTCP-NG and picoTCP, there are no checks for whether the ICMPv6 header consists of at least 8 bytes (set by RFC443). This leads to the function that creates ICMPv6 echo replies based on a received request with a smaller header to corrupt memory.CVE-2020-17443 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17443"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-17444",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "The function in picoTCP-NG and picoTCP that processes IPv6 headers does not check the lengths of extension header options, allowing an attacker to force this function into an infinite loop with crafted length values.CVE-2020-17444 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17444"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-17445",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The function in picoTCP-NG and picoTCP that processes the IPv6 destination options extension header does not check the validity of its options lengths, allowing an attacker to corrupt memory and/or put the function into an infinite loop with crafted length values.CVE-2020-17445 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17445"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-17467",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The function in FNET does not check whether domain names are null terminated when parsing Link-local Multicast Name Resolution (LLMNR) requests. This may allow an attacker to read out of bounds.CVE-2020-17467 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17467"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-17468",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The function in FNET that processes the IPv6 hop-by-hop extension header does not check the validity of its options lengths, allowing an attacker to corrupt memory.CVE-2020-17468 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17468"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-17469",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The IPv6 packet reassembly function in FNET does not check whether the received fragments are properly aligned in memory, allowing an attacker to perform memory corruption with crafted IPv6 fragmented packets.CVE-2020-17469 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17469"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-17470",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "The function in FNET that initializes the DNS client interface structure does not set sufficiently random transaction IDs (they will be always set to 1), facilitating DNS cache poisoning attacks.CVE-2020-17470 has been assigned to this vulnerability. A CVSS v3 base score of 4.0 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17470"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-24334",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The function in uIP-Contiki-NG, uIP-Contiki-OS, and uIP that processes DNS responses does not check whether the number of responses specified in the DNS packet header correspond to the response data available in the DNS packet, which may allow an attacker to corrupt memory.CVE-2020-24334 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24334"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-24335",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The function in uIP-Contiki-NG, uIP-Contiki-OS, and uIP that parses domain names lacks bounds checks, allowing an attacker to corrupt memory with crafted DNS packets.CVE-2020-24335 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24335"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-24336",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The function in uIP-Contiki-NG and uIP-Contiki-OS for parsing DNS records in DNS response packets sent over NAT64 does not validate the length field of the response records, allowing an attacker to corrupt memory.CVE-2020-24336 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24336"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-24337",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The function in picoTCP-NG and picoTCP that processes TCP options does not validate their lengths, allowing an attacker to put the function into an infinite loop with uncommon/unsupported TCP options that have crafted length values.CVE-2020-24337 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24337"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-24338",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The function in picoTCP and picoTCP-NG that parses domain names lacks bounds checks, allowing an attacker to corrupt memory with crafted DNS packets.CVE-2020-24338 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24338"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-24339",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The function in picoTCP and picoTCP-NG that processes DNS responses does not check whether the number of responses specified in the DNS packet header correspond to the response data available in the DNS packet, allowing an attacker to perform memory corruption.CVE-2020-24339 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24339"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-24340",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The function in picoTCP and picoTCP-NG that processes DNS responses does not check whether the number of responses specified in the DNS packet header correspond to the response data available in the DNS packet, allowing an attacker to perform memory corruption.CVE-2020-24340 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24340"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-24341",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The TCP input data processing function in picoTCP-NG and picoTCP does not validate the length of incoming TCP packets, allowing an attacker to read out of bounds and perform memory corruption.CVE-2020-24341 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24341"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-24383",
"cwe": {
"id": "CWE-170",
"name": "Improper Null Termination"
},
"notes": [
{
"category": "summary",
"text": "When parsing incoming DNS packets in FNET,there are no checks whether domain names are null-terminated. This may allow an attacker to achieve memory corruption and/or memory leak.CVE-2020-24383 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24383"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-25107",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The function in Nut/Net that processes DNS questions/responses has several issues: there is no check on whether a domain name is NULL-terminated; the DNS response data length is not checked (can be set to arbitrary value from a packet); the number of DNS queries/responses (set in DNS header) is not checked against the data present; the length byte of a domain name in a DNS query/response is not checked and is used for internal memory operations.CVE-2020-25107 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25107"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-25108",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The function in Nut/Net that processes DNS questions/responses has several issues: there is no check on whether a domain name is NULL-terminated; the DNS response data length is not checked (can be set to arbitrary value from a packet); the number of DNS queries/responses (set in DNS header) is not checked against the data present; the length byte of a domain name in a DNS query/response is not checked and is used for internal memory operations.CVE-2020-25108 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25108"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-25109",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The function in Nut/Net that processes DNS questions/responses has several issues: there is no check on whether a domain name is NULL-terminated; the DNS response data length is not checked (can be set to arbitrary value from a packet); the number of DNS queries/responses (set in DNS header) is not checked against the data present; the length byte of a domain name in a DNS query/response is not checked and is used for internal memory operations.CVE-2020-25109 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25109"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-25110",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The function in Nut/Net that processes DNS questions/responses has several issues: there is no check on whether a domain name is NULL-terminated; the DNS response data length is not checked (can be set to arbitrary value from a packet); the number of DNS queries/responses (set in DNS header) is not checked against the data present; the length byte of a domain name in a DNS query/response is not checked and is used for internal memory operations.CVE-2020-25110 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25110"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-25111",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The function in Nut/Net that processes DNS questions/responses has several issues: there is no check on whether a domain name is NULL-terminated; the DNS response data length is not checked (can be set to arbitrary value from a packet); the number of DNS queries/responses (set in DNS header) is not checked against the data present; the length byte of a domain name in a DNS query/response is not checked and is used for internal memory operations.CVE-2020-25111 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25111"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-25112",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "Vulnerabilities in uIP-Contiki-OS (EOL) provide insufficient checks for the IPv4/IPv6 header length and inconsistent checks for the IPv6 header extension lengths, which may allow an attacker to corrupt memory.CVE-2020-25112 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25112"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://yanzi.dev/#/security/advisories/2020-12-08"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
}
]
}
wid-sec-w-2022-1044
Vulnerability from csaf_certbund
Published
2020-12-08 23:00
Modified
2023-07-27 22:00
Summary
TCP/IP Stack: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Der TCP/IP-Stack bzw. die Internet Protocol Suite ist eine Reihe von Kommunikationsprotokollen, die vom Internet oder ähnlichen Netzwerken verwendet werden.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in TCP/IP Stack ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, einen Denial of Service Angriff durchzuführen, vertrauliche Daten einzusehen oder Daten zu manipulieren.
Betroffene Betriebssysteme
- Sonstiges
{
"document": {
"aggregate_severity": {
"text": "kritisch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Der TCP/IP-Stack bzw. die Internet Protocol Suite ist eine Reihe von Kommunikationsprotokollen, die vom Internet oder \u00e4hnlichen Netzwerken verwendet werden.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in TCP/IP Stack ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, einen Denial of Service Angriff durchzuf\u00fchren, vertrauliche Daten einzusehen oder Daten zu manipulieren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2022-1044 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2022-1044.json"
},
{
"category": "self",
"summary": "WID-SEC-2022-1044 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1044"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6259-1 vom 2023-07-27",
"url": "https://ubuntu.com/security/notices/USN-6259-1"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2021:1164-1 vom 2021-04-13",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2021-April/008619.html"
},
{
"category": "external",
"summary": "US ICS CERT Advisory ICSA-20-343-01 vom 2020-12-08",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01"
},
{
"category": "external",
"summary": "Pressemeldung des BSI vom 2020-12-08",
"url": "https://www.bsi.bund.de/DE/Presse/Kurzmeldungen/Meldungen/Amnesia_201208.html"
},
{
"category": "external",
"summary": "Unify Security Advisory Report OBSO-2101-01 vom 2021-01-08",
"url": "https://networks.unify.com/security/advisories/OBSO-2101-01.pdf"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2021:0663-1 vom 2021-03-01",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2021-March/008407.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2022:2806-1 vom 2022-08-15",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-August/011912.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2022:2861-1 vom 2022-08-22",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-August/011958.html"
}
],
"source_lang": "en-US",
"title": "TCP/IP Stack: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2023-07-27T22:00:00.000+00:00",
"generator": {
"date": "2024-02-15T16:55:36.942+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.0"
}
},
"id": "WID-SEC-W-2022-1044",
"initial_release_date": "2020-12-08T23:00:00.000+00:00",
"revision_history": [
{
"date": "2020-12-08T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2020-12-14T23:00:00.000+00:00",
"number": "2",
"summary": "Schreibfehler korrigiert"
},
{
"date": "2021-01-10T23:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von Unify aufgenommen"
},
{
"date": "2021-03-01T23:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2021-04-13T22:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2022-08-15T22:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2022-08-22T22:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2023-07-27T22:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von Ubuntu aufgenommen"
}
],
"status": "final",
"version": "8"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Open Source TCP/IP Stack",
"product": {
"name": "Open Source TCP/IP Stack",
"product_id": "T017866",
"product_identification_helper": {
"cpe": "cpe:/a:open_source:tcpip_stack:-"
}
}
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
},
{
"branches": [
{
"category": "product_name",
"name": "Ubuntu Linux",
"product": {
"name": "Ubuntu Linux",
"product_id": "T000126",
"product_identification_helper": {
"cpe": "cpe:/o:canonical:ubuntu_linux:-"
}
}
}
],
"category": "vendor",
"name": "Ubuntu"
},
{
"branches": [
{
"category": "product_name",
"name": "Unify OpenScape 4000",
"product": {
"name": "Unify OpenScape 4000",
"product_id": "T018011",
"product_identification_helper": {
"cpe": "cpe:/h:unify:openscape_4000:-"
}
}
},
{
"category": "product_name",
"name": "Unify OpenScape Alarm Response",
"product": {
"name": "Unify OpenScape Alarm Response",
"product_id": "T018013",
"product_identification_helper": {
"cpe": "cpe:/h:unify:openscape_alarm_response:-"
}
}
},
{
"category": "product_name",
"name": "Unify OpenScape Business",
"product": {
"name": "Unify OpenScape Business",
"product_id": "T018012",
"product_identification_helper": {
"cpe": "cpe:/a:unify:openscape_business:-"
}
}
},
{
"category": "product_name",
"name": "Unify OpenScape Common Management Platform",
"product": {
"name": "Unify OpenScape Common Management Platform",
"product_id": "T018017",
"product_identification_helper": {
"cpe": "cpe:/a:unify:openscape_common_management_platform:-"
}
}
},
{
"category": "product_name",
"name": "Unify OpenScape Cordless IP",
"product": {
"name": "Unify OpenScape Cordless IP",
"product_id": "T018016",
"product_identification_helper": {
"cpe": "cpe:/a:unify:openscape_cordless_ip:-"
}
}
},
{
"category": "product_name",
"name": "Unify OpenScape Desk Phone",
"product": {
"name": "Unify OpenScape Desk Phone",
"product_id": "T018015",
"product_identification_helper": {
"cpe": "cpe:/h:unify:openscape_deskphone:-"
}
}
},
{
"category": "product_name",
"name": "Unify OpenScape Xpert",
"product": {
"name": "Unify OpenScape Xpert",
"product_id": "T018014",
"product_identification_helper": {
"cpe": "cpe:/h:unify:openscape_xpert:-"
}
}
}
],
"category": "vendor",
"name": "Unify"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-13984",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-13984"
},
{
"cve": "CVE-2020-13985",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-13985"
},
{
"cve": "CVE-2020-13986",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-13986"
},
{
"cve": "CVE-2020-13987",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-13987"
},
{
"cve": "CVE-2020-13988",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-13988"
},
{
"cve": "CVE-2020-17437",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-17437"
},
{
"cve": "CVE-2020-17438",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-17438"
},
{
"cve": "CVE-2020-17439",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-17439"
},
{
"cve": "CVE-2020-17440",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-17440"
},
{
"cve": "CVE-2020-17441",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-17441"
},
{
"cve": "CVE-2020-17442",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-17442"
},
{
"cve": "CVE-2020-17443",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-17443"
},
{
"cve": "CVE-2020-17444",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-17444"
},
{
"cve": "CVE-2020-17445",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-17445"
},
{
"cve": "CVE-2020-17467",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-17467"
},
{
"cve": "CVE-2020-17468",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-17468"
},
{
"cve": "CVE-2020-17469",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-17469"
},
{
"cve": "CVE-2020-17470",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-17470"
},
{
"cve": "CVE-2020-24334",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-24334"
},
{
"cve": "CVE-2020-24335",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-24335"
},
{
"cve": "CVE-2020-24336",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-24336"
},
{
"cve": "CVE-2020-24337",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-24337"
},
{
"cve": "CVE-2020-24338",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-24338"
},
{
"cve": "CVE-2020-24339",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-24339"
},
{
"cve": "CVE-2020-24340",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-24340"
},
{
"cve": "CVE-2020-24341",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-24341"
},
{
"cve": "CVE-2020-24383",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-24383"
},
{
"cve": "CVE-2020-25107",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-25107"
},
{
"cve": "CVE-2020-25108",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-25108"
},
{
"cve": "CVE-2020-25109",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-25109"
},
{
"cve": "CVE-2020-25110",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-25110"
},
{
"cve": "CVE-2020-25111",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-25111"
},
{
"cve": "CVE-2020-25112",
"notes": [
{
"category": "description",
"text": "Im TCP/IP Stack existieren mehrere Schwachstellen in einer Vielzahl von Produkten aus den Bereichen IoT, Gesundheitswesen, Industrie und anderen Produkten von mehr als 150 verschiedenen Anbietern verwendet werden. Die Sammlung erhielt den Namen \"Amnesia:33\". Die Schwachstellen beruhen u. a. auf Puffer-\u00dcberlauf Fehlern, \"out-of-bounds\" Zugriffen oder Fehlern bei der Bereinigung von Eingaben. Ein Angreifer kann dieses zu Denial of Service Angriffen, zur Einsicht in vertrauliche Daten, zur Manipulation von Daten oder zur Ausf\u00fchrung von Code nutzen."
}
],
"product_status": {
"known_affected": [
"T018014",
"T018015",
"T018016",
"T018017",
"T002207",
"T000126",
"T017866",
"T018011",
"T018012",
"T018013"
]
},
"release_date": "2020-12-08T23:00:00Z",
"title": "CVE-2020-25112"
}
]
}
gsd-2020-24341
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Service or an information leak.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2020-24341",
"description": "An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Service or an information leak.",
"id": "GSD-2020-24341",
"references": [
"https://www.suse.com/security/cve/CVE-2020-24341.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2020-24341"
],
"details": "An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Service or an information leak.",
"id": "GSD-2020-24341",
"modified": "2023-12-13T01:22:12.756265Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-24341",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Service or an information leak."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.kb.cert.org/vuls/id/815128",
"refsource": "MISC",
"url": "https://www.kb.cert.org/vuls/id/815128"
},
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:altran:picotcp:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.7.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:altran:picotcp-ng:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.7.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-24341"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Service or an information leak."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01",
"refsource": "MISC",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01"
},
{
"name": "https://www.kb.cert.org/vuls/id/815128",
"refsource": "MISC",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.kb.cert.org/vuls/id/815128"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2
}
},
"lastModifiedDate": "2020-12-14T21:26Z",
"publishedDate": "2020-12-11T23:15Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.