CVE-2021-33586

EUVD-2021-20272
InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 40%
Affected Products (NVD)
VendorProductVersion
inspircdinspircd
3.8.0 ≤
𝑥
< 3.10.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
inspircd
bookworm
3.15.0-1
fixed
bullseye
3.8.1-2
fixed
buster
not-affected
sid
3.17.0-1
fixed
stretch
not-affected
trixie
3.17.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
inspircd
bionic
needs-triage
focal
needs-triage
groovy
ignored
hirsute
ignored
impish
ignored
jammy
needs-triage
kinetic
ignored
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
dne
xenial
needs-triage
Common Weakness Enumeration
References
https://docs.inspircd.org/security/2021-01/
https://github.com/inspircd/inspircd/commit/4350a11c663b0d75f8119743bffb7736d87abd4d
https://security.gentoo.org/glsa/202107-22
https://docs.inspircd.org/security/2021-01/
https://github.com/inspircd/inspircd/commit/4350a11c663b0d75f8119743bffb7736d87abd4d
https://security.gentoo.org/glsa/202107-22