SB2020040230 - Red Hat Virtualization Host update for cockpit-ovirt

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020040230

SB2020040230 - Red Hat Virtualization Host update for cockpit-ovirt

Published: April 2, 2020 Updated: April 12, 2023

Security Bulletin ID SB2020040230
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Null pointer dereference (CVE-ID: CVE-2018-14404)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear


The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists in the xmlXPathCompOpEval() function, as defined in the path.c source code file due to improper parsing of invalid XPath expressions in the XPATH_OP_AND and XPATH_OP_OR cases. A remote attacker can send a specially crafted request that submits malicious input to an application that is using the affected library, trigger a NULL pointer dereference and cause the application to crash.


Remediation

Install update from vendor's website.

References