Lucene search

MitreCVE-2019-20503

HistoryMar 06, 2020 - 8:15 p.m.

CVE-2019-20503

2020-03-0620:15:12

CWE-125

mitre

web.nvd.nist.gov

273

cve-2019-20503

usrsctp

security vulnerability

out-of-bounds reads

sctp_load_addresses_from_init

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

8.1

Confidence

High

EPSS

0.002

Percentile

57.0%

JSON

usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.

Affected configurations

Nvd

Node

usrsctp_projectusrsctpRange<0.9.4.0

Node

debiandebian_linuxMatch8.0

debiandebian_linuxMatch9.0

debiandebian_linuxMatch10.0

Node

canonicalubuntu_linuxMatch16.04esm

canonicalubuntu_linuxMatch18.04esm

canonicalubuntu_linuxMatch19.10

VendorProductVersionCPE
usrsctp_projectusrsctp*cpe:2.3:a:usrsctp_project:usrsctp:*:*:*:*:*:*:*:*
debiandebian_linux8.0cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
debiandebian_linux9.0cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
canonicalubuntu_linux16.04cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
canonicalubuntu_linux18.04cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*
canonicalubuntu_linux19.10cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
usrsctp_project	usrsctp	*	cpe:2.3:a:usrsctp_project:usrsctp::::::::
debian	debian_linux	8.0	cpe:2.3:o:debian:debian_linux:8.0:::::::*
debian	debian_linux	9.0	cpe:2.3:o:debian:debian_linux:9.0:::::::*
debian	debian_linux	10.0	cpe:2.3:o:debian:debian_linux:10.0:::::::*
canonical	ubuntu_linux	16.04	cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::
canonical	ubuntu_linux	18.04	cpe:2.3:o:canonical:ubuntu_linux:18.04::::esm:::
canonical	ubuntu_linux	19.10	cpe:2.3:o:canonical:ubuntu_linux:19.10:::::::*

References

lists.opensuse.org/opensuse-security-announce/2020-03/msg00022.html

lists.opensuse.org/opensuse-security-announce/2020-03/msg00028.html

lists.opensuse.org/opensuse-security-announce/2020-03/msg00030.html

lists.opensuse.org/opensuse-security-announce/2020-03/msg00037.html

seclists.org/fulldisclosure/2020/May/49

seclists.org/fulldisclosure/2020/May/52

seclists.org/fulldisclosure/2020/May/55

seclists.org/fulldisclosure/2020/May/59

access.redhat.com/errata/RHSA-2020:0815

access.redhat.com/errata/RHSA-2020:0816

access.redhat.com/errata/RHSA-2020:0819

access.redhat.com/errata/RHSA-2020:0820

bugs.chromium.org/p/project-zero/issues/detail?id=1992

chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_18.html

crbug.com/1059349

github.com/sctplab/usrsctp/commit/790a7a2555aefb392a5a69923f1e9d17b4968467

lists.debian.org/debian-lts-announce/2020/03/msg00013.html

lists.debian.org/debian-lts-announce/2020/03/msg00023.html

lists.debian.org/debian-lts-announce/2023/07/msg00003.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DDNOAGIX5D77TTHT6YPMVJ5WTXTCQEI/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWANFIR3PYAL5RJQ4AO3ZS2DYMSF2ZGZ/

security.gentoo.org/glsa/202003-02

security.gentoo.org/glsa/202003-10

support.apple.com/HT211168

support.apple.com/HT211171

support.apple.com/HT211175

support.apple.com/HT211177

support.apple.com/kb/HT211168

support.apple.com/kb/HT211171

support.apple.com/kb/HT211175

support.apple.com/kb/HT211177

usn.ubuntu.com/4299-1/

usn.ubuntu.com/4328-1/

usn.ubuntu.com/4335-1/

www.debian.org/security/2020/dsa-4639

www.debian.org/security/2020/dsa-4642

www.debian.org/security/2020/dsa-4645

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

8.1

Confidence

High

EPSS

0.002

Percentile

57.0%

JSON

CVE-2019-20503

Affected configurations

References

Related