CVE-2020-29363

An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 31%
VendorProductVersion
p11-kit_projectp11-kit
0.23.6 ≤
𝑥
< 0.23.22
debiandebian_linux
10.0
oraclecommunications_cloud_native_core_policy
1.14.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
p11-kit
bullseye
0.23.22-1
fixed
stretch
not-affected
bookworm
0.24.1-2
fixed
sid
0.25.5-2
fixed
trixie
0.25.5-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
p11-kit
hirsute
Fixed 0.23.22-1
released
groovy
Fixed 0.23.21-2ubuntu0.1
released
focal
Fixed 0.23.20-1ubuntu0.1
released
bionic
Fixed 0.23.9-2ubuntu0.1
released
xenial
not-affected
trusty
not-affected
Common Weakness Enumeration
References
https://github.com/p11-glue/p11-kit/releases
https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5j67-fw89-fp6x
https://www.debian.org/security/2021/dsa-4822
https://www.oracle.com/security-alerts/cpuapr2022.html
https://github.com/p11-glue/p11-kit/releases
https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5j67-fw89-fp6x
https://www.debian.org/security/2021/dsa-4822
https://www.oracle.com/security-alerts/cpuapr2022.html