Main Vulnerability Database Vulnerabilities #VU33366

Reachable Assertion in Kea - CVE-2019-6472

Published: October 16, 2019 / Updated: August 4, 2020

Vulnerability identifier: #VU33366

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-6472

CWE-ID: CWE-617

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.

Affected software

Kea
kea (Alpine package)
kea
Fedora

How to mitigate CVE-2019-6472

Install update from vendor's website.

kea - addressed in versions 1.5.0-9.fc30, 1.6.0-4.el7

External References

https://kb.isc.org/docs/cve-2019-6472

Related Security Bulletins