Out-of-bounds read in libmaxminddb - CVE-2020-28241

Vulnerability identifier: #VU48418

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-28241

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer over-read in dump_entry_data_list in maxminddb.c. A remote attacker can perform a denial of service attack.

libmaxminddb
Cloud Pak for Network Automation
Storage Virtualize
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
openEuler
Ubuntu
Fedora
libmaxminddb (Alpine package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libmaxminddb-debuginfo
libmaxminddb
libmaxminddb-devel
libmaxminddb-help
libmaxminddb-debugsource
libmaxminddb (Red Hat package)
libmaxminddb0 (Ubuntu package)
Service Telemetry Framework
Ansible Automation Platform
Red Hat Advanced Cluster Security for Kubernetes
IBM Cloud Transformation Advisor
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Juniper Secure Analytics (JSA)
Red Hat Single Sign-On
Red Hat OpenShift GitOps
IBM Qradar SIEM

Update to version 1.4.3.

libmaxminddb - update to 1.4.3
Service Telemetry Framework - update to 1.5.4
Migration Toolkit for Containers - addressed in versions 1.7.15, 1.8.3, 1.8.4
Cloud Pak for Network Automation - update to 2.7.2
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 4.3.5, 4.4.0
Red Hat OpenShift Container Platform - addressed in versions 4.11.59, 4.12.50, 4.13.34, 4.13.45, 4.14.13, 4.14.32, 4.14.33
Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
Red Hat Single Sign-On - update to 7.6.7
libmaxminddb-debuginfo - update to 1.2.0-8
libmaxminddb - update to 1.2.0-8
libmaxminddb-devel - update to 1.2.0-8
libmaxminddb-help - update to 1.2.0-8
libmaxminddb-debugsource - update to 1.2.0-8
libmaxminddb (Red Hat package) - addressed in versions 1.2.0-10.el8_6.1, 1.2.0-10.el8_8.1, 1.2.0-10.el8_9.1
libmaxminddb0 (Ubuntu package) - addressed in versions 1.4.2-0ubuntu1.20.04.1, 1.4.2-0ubuntu1.20.10.1
libmaxminddb - addressed in versions 1.4.3-1.fc32, 1.4.3-1.fc33
Red Hat OpenShift GitOps - addressed in versions 1.10.0, 1.11, 1.12.5, 1.13.1
IBM Cloud Transformation Advisor - update to 3.10.0
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF01
Storage Virtualize - addressed in versions 8.4.0.15, 8.5.0.13, 8.6.0.5, 8.7.0.0

• https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3
• https://github.com/maxmind/libmaxminddb/issues/236
• https://github.com/maxmind/libmaxminddb/pull/237
• https://lists.debian.org/debian-lts-announce/2020/11/msg00019.html

• Out-of-bounds read in MaxMind libmaxminddb
• Out-of-bounds read in libmaxminddb (Alpine package)
• Gentoo update for libmaxminddb
• Red Hat Enterprise Linux 8.8 Extended Update Support update for libmaxminddb
• Red Hat Enterprise Linux 8.6 Extended Update Support update for libmaxminddb
• Red Hat Enterprise Linux 8 update for libmaxminddb
• Multiple vulnerabilities in OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• openEuler update for libmaxminddb
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4 for RHEL 9
• Multiple vulnerabilities in Service Telemetry Framework 1.5
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.11
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.3
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.4
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC) 1.8
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC) 1.7
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.13
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Storage Virtualize
• Multiple vulnerabilities in Migration Toolkit for Containers 1.8
• Ubuntu update for libmaxminddb
• Fedora 33 update for libmaxminddb
• Fedora 32 update for libmaxminddb