CVE-2013-0250 — Corosync vulnerability

5 documents5 sources
Severity
5.0MEDIUMNVD
EPSS
0.9%
top 23.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
CorosyncDebian Corosync
Timeline
PublishedJun 6
Latest updateMay 5

Description

The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does not properly initialize the HMAC key, which allows remote attackers to cause a denial of service (crash) via a crafted packet.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶NVDcorosync/corosync7 versions+6

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-f3cv-gjqx-mcfh: The init_nss_hash function in exec/totemcrypto↗2022-05-05
▶

📋Vendor Advisories

2
Red Hat
2.x: Remote DoS due improper HMAC initialization↗2013-01-18
▶
Debian
CVE-2013-0250: corosync - The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does...↗2013
▶

💬Community

1
Bugzilla
corosync 2.x: Remote DoS due improper HMAC initialization↗2013-02-01
▶