7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.006 Low
EPSS
Percentile
77.4%
The p11-glue project reports:
CVE-2020-29363: Out-of-bounds write in
p11_rpc_buffer_get_byte_array_value functionA heap-based buffer
overflow has been discovered in the RPC protocol used by p11-kit
server/remote commands and the client library. When the remote
entity supplies a serialized byte array in a CK_ATTRIBUTE, the
receiving entity may not allocate sufficient length for the buffer
to store the deserialized value.
CVE-2020-29362: Out-of-bounds read in p11_rpc_buffer_get_byte_array
functionA heap-based buffer over-read has been discovered in
the RPC protocol used by thep11-kit server/remote commands and the
client library. When the remote entity supplies a byte array through
a serialized PKCS#11 function call, the receiving entity may allow
the reading of up to 4 bytes of memory past the heap
allocation.
CVE-2020-29361: Integer overflow when allocating memory for arrays
of attributes and object identifiersMultiple integer overflows
have been discovered in the array allocations in the p11-kit library
and the p11-kit list command, where overflow checks are missing
before calling realloc or calloc.
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.006 Low
EPSS
Percentile
77.4%