CVE-2020-17446

Опубликовано: 12 авг. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, because of access to an uninitialized pointer in the array data decoder.

Ссылки

https://github.com/MagicStack/asyncpg/releases/tag/v0.21.0
Patch
Release Notes
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00002.html
Mailing List
Third Party Advisory
https://github.com/MagicStack/asyncpg/releases/tag/v0.21.0
Patch
Release Notes
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00002.html
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:magic:asyncpg:*:*:*:*:*:*:*:*

Версия до 0.21.0 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 84%

0.02141

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-824

Связанные уязвимости

CVE-2020-17446

CVSS3: 9.8

ubuntu

больше 5 лет назад

CVE-2020-17446

CVSS3: 9.8

debian

больше 5 лет назад

asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger ...

GHSA-2xpj-f5g2-8p7m

CVSS3: 9.8

github

почти 5 лет назад

Asyncpg Arbitrary Code Execution Via Access to an Uninitialized Pointer

EPSS

Процентиль: 84%

0.02141

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-824