CVE-2020-24334

Опубликовано: 11 дек. 2020

Источник: nvd

CVSS3: 8.2

CVSS2: 6.4

EPSS Низкий

Описание

The code that processes DNS responses in uIP through 1.0, as used in Contiki and Contiki-NG, does not check whether the number of responses specified in the DNS packet header corresponds to the response data available in the DNS packet, leading to an out-of-bounds read and Denial-of-Service in resolv.c.

Ссылки

https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
Third Party Advisory
US Government Resource
https://www.kb.cert.org/vuls/id/815128
Third Party Advisory
US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
Third Party Advisory
US Government Resource
https://www.kb.cert.org/vuls/id/815128
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:uip_project:uip:*:*:*:*:*:*:*:*

Версия до 1.0 (включая)

Одно из

cpe:2.3:o:contiki-ng:contiki-ng:-:*:*:*:*:*:*:*

cpe:2.3:o:contiki-os:contiki:-:*:*:*:*:*:*:*

EPSS

Процентиль: 70%

0.00639

Низкий

8.2 High

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-125

Связанные уязвимости

GHSA-38jp-4v3p-cc3q

github

больше 3 лет назад