CVE-2020-29363CWE-787

CVE-2020-29363

High · published December 16, 2020

CVSS v3.1
7.5
EPSS
4%
Percentile
89.2
In the wild
Unconfirmed
What it is

An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.03528 · 89.2th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2020-12-16T19:15Z
Affected products (3)
ProductVersionsFixed in
p11-kit_project/p11-kit≥ 0.23.6, < 0.23.220.23.22
debian/debian_linuxall versions—
oracle/communications_cloud_native_core_policyall versions—
References (9)
https://github.com/p11-glue/p11-kit/releases · [email protected]https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5j67-fw89-fp6x · [email protected]https://www.debian.org/security/2021/dsa-4822 · [email protected]https://www.oracle.com/security-alerts/cpuapr2022.html · [email protected]https://github.com/p11-glue/p11-kit/releases · af854a3a-2127-422b-91ae-364da2661108https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5j67-fw89-fp6x · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2021/dsa-4822 · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2022.html · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 16 DEC 13:29Z
    An issue was discovered in p11-kit 0.23.6 through 0.23.21
    cvelistv5