CVE-2020-1921
published 2021-03-10CVE-2020-1921: In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.21%
64.6th percentile
In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hhvm | < 4.56.3 | 4.56.3 | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | >= 4.57.0 < unspecified | unspecified | |
| hhvm | >= 4.57.0 < 4.80.2 | 4.80.2 | |
| hhvm | >= 4.81.0 < unspecified | unspecified | |
| hhvm | >= 4.81.0 < 4.93.2 | 4.93.2 | |
| hhvm | >= unspecified < 4.56.3 | 4.56.3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x3g2-p3p4-fghf: In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer
ghsa_unreviewed·2022-05-24
CVE-2020-1921 [HIGH] CWE-787 GHSA-x3g2-p3p4-fghf: In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer
In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
OSV
CVE-2020-1921: In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer
osv·2021-03-10·CVSS 7.5
CVE-2020-1921 [HIGH] CVE-2020-1921: In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer
In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
No detection rules found.
No public exploits indexed.
2021-03-10
Published