Lucene search

MitreCVE-2020-25269

HistorySep 11, 2020 - 5:15 a.m.

CVE-2020-25269

2020-09-1105:15:12

CWE-416

mitre

web.nvd.nist.gov

inspircd

cve-2020-25269

use after free

pgsql module

sqlauth

sqloper

remote crashing

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:N/A:C

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.3

Confidence

High

EPSS

0.005

Percentile

76.4%

JSON

An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains a use after free vulnerability. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.

Affected configurations

Nvd

Node

inspircdinspircdRange2.0–2.0.29

inspircdinspircdRange3.0–3.6.0

Node

debiandebian_linuxMatch9.0

debiandebian_linuxMatch10.0

VendorProductVersionCPE
inspircdinspircd*cpe:2.3:a:inspircd:inspircd:*:*:*:*:*:*:*:*
debiandebian_linux9.0cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
inspircd	inspircd	*	cpe:2.3:a:inspircd:inspircd::::::::
debian	debian_linux	9.0	cpe:2.3:o:debian:debian_linux:9.0:::::::*
debian	debian_linux	10.0	cpe:2.3:o:debian:debian_linux:10.0:::::::*

References

docs.inspircd.org/security/2020-01/

github.com/inspircd/inspircd/compare/426d1c8...b3f1db9

github.com/inspircd/inspircd/compare/v2.0.28...07d7dea

lists.debian.org/debian-lts-announce/2020/09/msg00015.html

www.debian.org/security/2020/dsa-4764

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:N/A:C

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.3

Confidence

High

EPSS

0.005

Percentile

76.4%

JSON

Related for CVE-2020-25269