CVE-2020-29363 — Out-of-bounds Write in Project P11-kit

CWE-787 — Out-of-bounds Write8 documents8 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 42.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
P11-kit Project P11-kitDebian P11-kitDebian Linux+2 more
Timeline
PublishedDec 16
Latest updateDec 14

Description

An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶debiandebian/p11-kit< p11-kit 0.23.22-1 (bookworm)
▶NVDp11-kit_project/p11-kit0.23.6 — 0.23.22
▶Debianp11-kit_project/p11-kit< 0.23.22-1+3

Also affects: Debian Linux 10.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

1
OSV
CVE-2020-29363: An issue was discovered in p11-kit 0↗2020-12-16
▶

📋Vendor Advisories

6
CISA ICS
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1↗2023-12-14
▶
Oracle
Oracle Oracle Communications Risk Matrix: Policy (p11-kit) — CVE-2020-29363↗2022-04-15
▶
Ubuntu
p11-kit vulnerabilities↗2021-01-05
▶
Red Hat
p11-kit: out-of-bounds write in p11_rpc_buffer_get_byte_array_value function in rpc-message.c↗2020-12-12
▶
Microsoft
An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the ↗2020-12-08
▶
CVE-2020-29363 — Out-of-bounds Write in Project P11-kit | cvebase