CVE-2020-28241

libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 47%
Affected Products (NVD)
VendorProductVersion
maxmindlibmaxminddb
𝑥
< 1.4.3
debiandebian_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libmaxminddb
bookworm
1.7.1-1
fixed
bullseye
1.5.2-1
fixed
sid
1.11.0-1
fixed
trixie
1.11.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libmaxminddb
bionic
needed
focal
Fixed 1.4.2-0ubuntu1.20.04.1
released
groovy
Fixed 1.4.2-0ubuntu1.20.10.1
released
hirsute
Fixed 1.4.2-0ubuntu2
released
impish
Fixed 1.4.2-0ubuntu2
released
jammy
Fixed 1.4.2-0ubuntu2
released
kinetic
Fixed 1.4.2-0ubuntu2
released
lunar
Fixed 1.4.2-0ubuntu2
released
mantic
Fixed 1.4.2-0ubuntu2
released
noble
Fixed 1.4.2-0ubuntu2
released
trusty
dne
xenial
Fixed 1.0.4-2.1ubuntu0.1~esm1
released
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
libmaxminddb
RHEL 8
0:1.2.0-10.el8_9.1
fixed
RHEL 8.6 AUS
0:1.2.0-10.el8_6.1
fixed
RHEL 8.6 E4S
0:1.2.0-10.el8_6.1
fixed
RHEL 8.6 EUS
0:1.2.0-10.el8_6.1
fixed
RHEL 8.6 TUS
0:1.2.0-10.el8_6.1
fixed
RHEL 8.8 AUS
0:1.2.0-10.el8_8.1
fixed
RHEL 8.8 E4S
0:1.2.0-10.el8_8.1
fixed
RHEL 8.8 EUS
0:1.2.0-10.el8_8.1
fixed
RHEL 8.8 TUS
0:1.2.0-10.el8_8.1
fixed
libmaxminddb-devel
RHEL 8
0:1.2.0-10.el8_9.1
fixed
RHEL 8.6 AUS
0:1.2.0-10.el8_6.1
fixed
RHEL 8.6 E4S
0:1.2.0-10.el8_6.1
fixed
RHEL 8.6 EUS
0:1.2.0-10.el8_6.1
fixed
RHEL 8.6 TUS
0:1.2.0-10.el8_6.1
fixed
RHEL 8.8 AUS
0:1.2.0-10.el8_8.1
fixed
RHEL 8.8 E4S
0:1.2.0-10.el8_8.1
fixed
RHEL 8.8 EUS
0:1.2.0-10.el8_8.1
fixed
RHEL 8.8 TUS
0:1.2.0-10.el8_8.1
fixed
Common Weakness Enumeration
References
https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3
https://github.com/maxmind/libmaxminddb/issues/236
https://github.com/maxmind/libmaxminddb/pull/237
https://lists.debian.org/debian-lts-announce/2020/11/msg00019.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WUK4UCOB5FJVK36E22IRLEYGKMUWGBG/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ELTOHZBPO6XVUVADP4DPZBNQCPTYOQBV/
https://security.gentoo.org/glsa/202011-15
https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3
https://github.com/maxmind/libmaxminddb/issues/236
https://github.com/maxmind/libmaxminddb/pull/237
https://lists.debian.org/debian-lts-announce/2020/11/msg00019.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WUK4UCOB5FJVK36E22IRLEYGKMUWGBG/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ELTOHZBPO6XVUVADP4DPZBNQCPTYOQBV/
https://security.gentoo.org/glsa/202011-15