CVE-2023-20197

CWE-8358 documents7 sources
Severity
7.5HIGH
EPSS
0.4%
top 36.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Cisco Secure EndpointCisco Secure Endpoint Private CloudCisco Cisco Secure Endpoint+2 more
Timeline
PublishedAug 16
Latest updateAug 21

Description

A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be s…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶Debianclamav< 0.103.9+dfsg-0+deb11u1+3
▶NVDcisco/secure_endpoint8.0.1.21160 — 8.1.7.21585+2
▶CVEListV5cisco/cisco_secure_endpoint47 versions+46

Also affects: Fedora 38

🔴Vulnerability Details

3
GHSA
GHSA-r7mw-p665-4533: A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to c↗2023-08-17
▶
CVEList
CVE-2023-20197: A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to c↗2023-08-16
▶
OSV
CVE-2023-20197: A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to c↗2023-08-16
▶

📋Vendor Advisories

4
Ubuntu
ClamAV vulnerability↗2023-08-21
▶
Ubuntu
ClamAV vulnerability↗2023-08-21
▶
Cisco
ClamAV HFS+ File Scanning Infinite Loop Denial of Service Vulnerability↗2023-08-16
▶
Debian
CVE-2023-20197: clamav - A vulnerability in the filesystem image parser for Hierarchical File System Plus...↗2023
▶
CVE-2023-20197 (HIGH CVSS 7.5) | A vulnerability in the filesystem i | cvebase.io