CVE-2019-20892
published 2020-06-25CVE-2019-20892: net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp…
medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | net-snmp | < net-snmp 5.8+dfsg-3 (bookworm) | net-snmp 5.8+dfsg-3 (bookworm) |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_net-snmp_5.9-3_on_cbl_mariner_1.0 | — | — |
| net-snmp | net-snmp | <= 5.8 | — |
| net-snmp | net-snmp | >= 0 < 5.8+dfsg-3 | 5.8+dfsg-3 |
| net-snmp | net-snmp | >= 0 < 5.8+dfsg-3 | 5.8+dfsg-3 |
| net-snmp | net-snmp | >= 0 < 5.8+dfsg-3 | 5.8+dfsg-3 |
| net-snmp | net-snmp | >= 0 < 5.8+dfsg-3 | 5.8+dfsg-3 |
| net-snmp | net-snmp | >= 0 < 5.8+dfsg-2ubuntu2.1 | 5.8+dfsg-2ubuntu2.1 |
| oracle | zfs_storage_appliance_kit | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv6.5MEDIUM