CVE-2018-20721
uriparser: Out-of-bounds read in uriParse*Ex*
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Ubuntu (orta), Red Hat (düşük).
Açıklama
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 11 | uriparser | 0.9.1-1 |
| debian 12 | uriparser | 0.9.1-1 |
| debian 13 | uriparser | 0.9.1-1 |
| debian 14 | uriparser | 0.9.1-1 |
| debian 8 | uriparser | 0.8.0.1-2+deb8u2 |
| debian 9 | uriparser | 0.8.4-1+deb9u2 |
| echo | uriparser | 0.9.1-1 |
| Red Hat | uriparser, uriparser-devel | düzeltme belirtilmemiş |
| root.io debian 12 | rootio-uriparser | 0.9.1-1 |
| ubuntu 14.04-ESM | uriparser | 0.7.5-1ubuntu2+esm2 |
| ubuntu 16.04-ESM | uriparser | 0.8.4-1ubuntu0.16.04.1~esm2 |
| ubuntu 18.04 | uriparser | 0.8.4-1+deb9u2build0.18.04.1 |
13 kaynaktaki 14 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 11 | uriparser | 0.9.1-1 |
| debian 12 | uriparser | 0.9.1-1 |
| debian 13 | uriparser | 0.9.1-1 |
| debian 14 | uriparser | 0.9.1-1 |
| debian 8 | uriparser | 0.8.0.1-2+deb8u2 |
| debian 9 | uriparser | 0.8.4-1+deb9u2 |
| echo | uriparser | 0.9.1-1 |
| Red Hat | uriparser | düzeltme belirtilmemiş |
| Red Hat | uriparser-devel | düzeltme belirtilmemiş |
| root.io debian 12 | rootio-uriparser | 0.9.1-1 |
| ubuntu 14.04-ESM | uriparser | 0.7.5-1ubuntu2+esm2 |
| ubuntu 16.04-ESM | uriparser | 0.8.4-1ubuntu0.16.04.1~esm2 |
| ubuntu 18.04 | uriparser | 0.8.4-1+deb9u2build0.18.04.1 |
| ubuntu 18.04-ESM | uriparser | 0.8.4-1+deb9u2build0.18.04.1 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2018-20721
- https://github.com/uriparser/uriparser/blob/master/ChangeLog
- https://github.com/uriparser/uriparser/commit/cef25028de5ff872c2e1f0a6c562eb3ea9ecbce4
- https://lists.debian.org/debian-lts-announce/2019/02/msg00028.html
- https://lists.debian.org/debian-lts-announce/2021/11/msg00029.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-20721
- https://ubuntu.com/security/notices/USN-5172-1
- https://ubuntu.com/security/notices/USN-5172-2