CVE-2020-28241

libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 43%
VendorProductVersion
maxmindlibmaxminddb
𝑥
< 1.4.3
debiandebian_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libmaxminddb
bullseye
1.5.2-1
fixed
bookworm
1.7.1-1
fixed
sid
1.11.0-1
fixed
trixie
1.11.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libmaxminddb
noble
Fixed 1.4.2-0ubuntu2
released
mantic
Fixed 1.4.2-0ubuntu2
released
lunar
Fixed 1.4.2-0ubuntu2
released
kinetic
Fixed 1.4.2-0ubuntu2
released
jammy
Fixed 1.4.2-0ubuntu2
released
impish
Fixed 1.4.2-0ubuntu2
released
hirsute
Fixed 1.4.2-0ubuntu2
released
groovy
Fixed 1.4.2-0ubuntu1.20.10.1
released
focal
Fixed 1.4.2-0ubuntu1.20.04.1
released
bionic
needed
xenial
Fixed 1.0.4-2.1ubuntu0.1~esm1
released
trusty
dne
Common Weakness Enumeration
References
https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3
https://github.com/maxmind/libmaxminddb/issues/236
https://github.com/maxmind/libmaxminddb/pull/237
https://lists.debian.org/debian-lts-announce/2020/11/msg00019.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WUK4UCOB5FJVK36E22IRLEYGKMUWGBG/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ELTOHZBPO6XVUVADP4DPZBNQCPTYOQBV/
https://security.gentoo.org/glsa/202011-15
https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3
https://github.com/maxmind/libmaxminddb/issues/236
https://github.com/maxmind/libmaxminddb/pull/237
https://lists.debian.org/debian-lts-announce/2020/11/msg00019.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WUK4UCOB5FJVK36E22IRLEYGKMUWGBG/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ELTOHZBPO6XVUVADP4DPZBNQCPTYOQBV/
https://security.gentoo.org/glsa/202011-15