CVE-2020-3517
published 2020-08-27CVE-2020-3517: A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated attacker to cause process…
PriorityP348high8.6CVSS 3.1
AVNACLPRNUINSCCNINAH
EPSS
1.37%
69.0th percentile
A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated attacker to cause process crashes, which could result in a denial of service (DoS) condition on an affected device. The attack vector is configuration dependent and could be remote or adjacent. For more information about the attack vector, see the Details section of this advisory. The vulnerability is due to insufficient error handling when the affected software parses Cisco Fabric Services messages. An attacker could exploit this vulnerability by sending malicious Cisco Fabric Services messages to an affected device. A successful exploit could allow the attacker to cause a reload of an affected device, which could result in a DoS condition.
Affected
293 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_nx-os_software | — | — |
| cisco | firepower_extensible_operating_system | >= 1.1 < 1.1.4.179 | 1.1.4.179 |
| cisco | firepower_extensible_operating_system | >= 2.0 < 2.0.1.153 | 2.0.1.153 |
| cisco | firepower_extensible_operating_system | >= 2.1 < 2.1.1.86 | 2.1.1.86 |
| cisco | firepower_extensible_operating_system | >= 2.2 < 2.2.1.70 | 2.2.1.70 |
| cisco | fxos_and_nx-os | — | — |
| cisco | nx-os | < 3.2\(3o\) | 3.2\(3o\) |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
nvdv3.08.6HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
ghsa7.5HIGH
vendor_cisco8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8cw5-4pj3-6hp9: A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated attacker to caus
ghsa_unreviewed·2022-05-24
CVE-2020-3517 [HIGH] CWE-476 GHSA-8cw5-4pj3-6hp9: A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated attacker to caus
A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated attacker to cause process crashes, which could result in a denial of service (DoS) condition on an affected device. The attack vector is configuration dependent and could be remote or adjacent. For more information about the attack vector, see the Details section of this advisory. The vulnerability is due to insufficient error handling when the affected software parses Cisco Fabric Services messages. An attacker could exploit this vulnerability by sending malicious Cisco Fabric Services messages to an affected device. A successful exploit could allow the attacker to cause a reload of an affected device, which could result in a DoS condition.
GHSA
Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12
ghsa·2021-05-17·CVSS 7.5
CVE-2019-20388 [HIGH] Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12
Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12
### Summary
Nokogiri v1.11.4 updates the vendored libxml2 from v2.9.10 to v2.9.12 which addresses:
- [CVE-2019-20388](https://security.archlinux.org/CVE-2019-20388) (Medium severity)
- [CVE-2020-24977](https://security.archlinux.org/CVE-2020-24977) (Medium severity)
- [CVE-2021-3517](https://security.archlinux.org/CVE-2021-3517) (Medium severity)
- [CVE-2021-3518](https://security.archlinux.org/CVE-2021-3518) (Medium severity)
- [CVE-2021-3537](https://security.archlinux.org/CVE-2021-3537) (Low severity)
- [CVE-2021-3541](https://security.archlinux.org/CVE-2021-3541) (Low severity)
Note that two additional CVEs were addressed upstream but are not relevant to this release. [CVE-2021-3516](https://security.archlinux.or
Cisco
Cisco FXOS and NX-OS Software Cisco Fabric Services Denial of Service Vulnerability
vendor_cisco·2020-08-26·CVSS 8.6
CVE-2020-3517 [HIGH] CWE-476 Cisco FXOS and NX-OS Software Cisco Fabric Services Denial of Service Vulnerability
Cisco FXOS and NX-OS Software Cisco Fabric Services Denial of Service Vulnerability
A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated attacker to cause process crashes, which could result in a denial of service (DoS) condition on an affected device. The attack vector is configuration dependent and could be remote or adjacent. For more information about the attack vector, see the Details section of this advisory.
The vulnerability is due to insufficient error handling when the affected software parses Cisco Fabric Services messages. An attacker could exploit this vulnerability by sending malicious Cisco Fabric Services messages to an affected device. A successful exploit could allow the attacker to cause a
Cisco
Cisco FXOS and NX-OS Software Cisco Fabric Services Denial of Service Vulnerability
vendor_cisco·CVSS 3.0
CVE-2020-3517 Cisco FXOS and NX-OS Software Cisco Fabric Services Denial of Service Vulnerability
CVE-2020-3517: Cisco FXOS and NX-OS Software Cisco Fabric Services Denial of Service Vulnerability
A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated attacker to cause process crashes, which could result in a denial of service (DoS) condition on an affected device. The attack vector is configuration dependent and could be remote or adjacent. For more information about the attack vector, see the
CVSS: 3.0
CWE: CWE-476, CWE-476
Bug IDs: CSCvt39630, CSCvt46835, CSCvt46837, CSCvt39630, CSCvt46835
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-08-27
Published