The vulnerability of the p11_rpc_buffer_get_byte_array_value function in the library for working with PKCS P11-kit modules, related to writing beyond the buffer’s boundaries, allows a hacker to cause a service failure.

🗓️ 06 Apr 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Vulnerability in p11_rpc_buffer_get_byte_array_value allows out-of-bounds writes and remote service disruption.

Reporter	Title	Published	Views	Family All 86
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities	3 Dec 202118:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in go.etcd.io/etcd package affects IBM Watson Machine Learning Accelerator on Cloud Pak for Data	6 Dec 202316:17	–	ibm
Tenable Nessus	Amazon Linux 2 : p11-kit (ALAS-2021-1601)	12 Mar 202100:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0088: p11-kit (ALINUX3-SA-2022:0088)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : p11-kit (ALSA-2021:1609)	9 Feb 202200:00	–	nessus
Tenable Nessus	CentOS 8 : p11-kit (CESA-2021:1609)	19 May 202100:00	–	nessus
Tenable Nessus	Debian DSA-4822-1 : p11-kit - security update	4 Jan 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : p11-kit (EulerOS-SA-2021-1015)	4 Jan 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : p11-kit (EulerOS-SA-2021-1034)	4 Jan 202100:00	–	nessus

Vulners

Node

daiki_ueno p11-kitRange0.23.6–0.23.22aurora

OR

red_hat red_hat_enterprise_linuxMatch8

OR

canonical ubuntuMatch20.10

Source	Link
access	www.access.redhat.com/security/cve/CVE-2020-29363
github	www.github.com/p11-glue/p11-kit/commit/2617f3ef888e103324a28811886b99ed0a56346d
github	www.github.com/p11-glue/p11-kit/security/advisories/GHSA-5j67-fw89-fp6x
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-29363
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-29363
ubuntu	www.ubuntu.com/security/notices/USN-4677-1
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.1/
cve	www.cve.omp.ru/bb27514
web	www.web.nvd.nist.gov/view/vuln/detail

05 Sep 2025 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 25

CVSS 37.5

EPSS0.03515

byte array value buffer boundary remote attacker service disruption cryptography module