CVE-2018-20679

2019-01-0916:29:00

Alpine Linux Development Team

security.alpinelinux.org

0.006 Low

EPSS

Percentile

77.7%

JSON

An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.

OSVersionArchitecturePackageVersionFilename
Alpineedge-mainnoarchbusybox< 1.29.3-r10UNKNOWN
Alpine3.10-mainnoarchbusybox< 1.29.3-r10UNKNOWN
Alpine3.11-mainnoarchbusybox< 1.29.3-r10UNKNOWN
Alpine3.12-mainnoarchbusybox< 1.29.3-r10UNKNOWN
Alpine3.13-mainnoarchbusybox< 1.29.3-r10UNKNOWN
Alpine3.14-mainnoarchbusybox< 1.29.3-r10UNKNOWN
Alpine3.15-mainnoarchbusybox< 1.29.3-r10UNKNOWN
Alpine3.16-mainnoarchbusybox< 1.29.3-r10UNKNOWN
Alpine3.17-mainnoarchbusybox< 1.29.3-r10UNKNOWN
Alpine3.18-mainnoarchbusybox< 1.29.3-r10UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	edge-main	noarch	busybox	< 1.29.3-r10	UNKNOWN
Alpine	3.10-main	noarch	busybox	< 1.29.3-r10	UNKNOWN
Alpine	3.11-main	noarch	busybox	< 1.29.3-r10	UNKNOWN
Alpine	3.12-main	noarch	busybox	< 1.29.3-r10	UNKNOWN
Alpine	3.13-main	noarch	busybox	< 1.29.3-r10	UNKNOWN
Alpine	3.14-main	noarch	busybox	< 1.29.3-r10	UNKNOWN
Alpine	3.15-main	noarch	busybox	< 1.29.3-r10	UNKNOWN
Alpine	3.16-main	noarch	busybox	< 1.29.3-r10	UNKNOWN
Alpine	3.17-main	noarch	busybox	< 1.29.3-r10	UNKNOWN
Alpine	3.18-main	noarch	busybox	< 1.29.3-r10	UNKNOWN