CVE-2020-10703

2020-06-0213:15:10

Google

osv.dev

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7 High

AI Score

Confidence

High

8.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

0.21 Low

EPSS

Percentile

96.3%

JSON

A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon, resulting in a potential denial of service.

CPENameOperatorVersion
libvirteq4.4.0
libvirteq0.9.12
libvirteq0.6.1
libvirteq1.3.0-rc1
libvirteq1.0.4-rc2
libvirteq1.0.2-rc1
libvirteq3.4.0-rc2
libvirteq0.9.7-rc1
libvirteq0.1.8
libvirteq1.1.2

Name	Operator	Version
libvirt	eq	4.4.0
libvirt	eq	0.9.12
libvirt	eq	0.6.1
libvirt	eq	1.3.0-rc1
libvirt	eq	1.0.4-rc2
libvirt	eq	1.0.2-rc1
libvirt	eq	3.4.0-rc2
libvirt	eq	0.9.7-rc1
libvirt	eq	0.1.8
libvirt	eq	1.1.2