CVE-2018-20721
uriparser: Out-of-bounds read in uriParse*Ex*
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Ubuntu (media), Red Hat (baja).
Descripción
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | uriparser | 0.9.1-1 |
| debian 12 | uriparser | 0.9.1-1 |
| debian 13 | uriparser | 0.9.1-1 |
| debian 14 | uriparser | 0.9.1-1 |
| debian 8 | uriparser | 0.8.0.1-2+deb8u2 |
| debian 9 | uriparser | 0.8.4-1+deb9u2 |
| echo | uriparser | 0.9.1-1 |
| Red Hat | uriparser, uriparser-devel | sin corrección indicada |
| root.io debian 12 | rootio-uriparser | 0.9.1-1 |
| ubuntu 14.04-ESM | uriparser | 0.7.5-1ubuntu2+esm2 |
| ubuntu 16.04-ESM | uriparser | 0.8.4-1ubuntu0.16.04.1~esm2 |
| ubuntu 18.04 | uriparser | 0.8.4-1+deb9u2build0.18.04.1 |
Mostrar las 14 entradas de 13 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | uriparser | 0.9.1-1 |
| debian 12 | uriparser | 0.9.1-1 |
| debian 13 | uriparser | 0.9.1-1 |
| debian 14 | uriparser | 0.9.1-1 |
| debian 8 | uriparser | 0.8.0.1-2+deb8u2 |
| debian 9 | uriparser | 0.8.4-1+deb9u2 |
| echo | uriparser | 0.9.1-1 |
| Red Hat | uriparser | sin corrección indicada |
| Red Hat | uriparser-devel | sin corrección indicada |
| root.io debian 12 | rootio-uriparser | 0.9.1-1 |
| ubuntu 14.04-ESM | uriparser | 0.7.5-1ubuntu2+esm2 |
| ubuntu 16.04-ESM | uriparser | 0.8.4-1ubuntu0.16.04.1~esm2 |
| ubuntu 18.04 | uriparser | 0.8.4-1+deb9u2build0.18.04.1 |
| ubuntu 18.04-ESM | uriparser | 0.8.4-1+deb9u2build0.18.04.1 |
Referencias
- https://access.redhat.com/security/cve/CVE-2018-20721
- https://github.com/uriparser/uriparser/blob/master/ChangeLog
- https://github.com/uriparser/uriparser/commit/cef25028de5ff872c2e1f0a6c562eb3ea9ecbce4
- https://lists.debian.org/debian-lts-announce/2019/02/msg00028.html
- https://lists.debian.org/debian-lts-announce/2021/11/msg00029.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-20721
- https://ubuntu.com/security/notices/USN-5172-1
- https://ubuntu.com/security/notices/USN-5172-2