Buffer overflow in p11-kit - CVE-2020-29362

Vulnerability identifier: #VU48945

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-29362

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a unspecified boundary error, related to processing of RPC requests. A remote attacker can perform a denial of service (DoS) attack.

p11-kit
Dell Data Protection Central
Dell EMC PowerProtect Data Protection
Tanzu Greenplum for Kubernetes
IBM Watson Machine Learning Accelerator
Platform Automation Toolkit
p11-kit (Alpine package)
p11-kit (Debian package)
SUSE Linux Enterprise Module for Packagehub Subpackages
p11-kit-modules (Ubuntu package)
p11-kit (Ubuntu package)
libp11-kit0 (Ubuntu package)
p11-kit-debuginfo-32bit
p11-kit-debuginfo
p11-kit-debugsource
p11-kit-devel
libp11-kit0
libp11-kit0-debuginfo
p11-kit-nss-trust
p11-kit-tools
p11-kit-tools-debuginfo
libp11-kit0-32bit
p11-kit-32bit
libp11-kit0-debuginfo-32bit
p11-kit
libp11-kit0-32bit-debuginfo
p11-kit-32bit-debuginfo
p11-kit-nss-trust-32bit
p11-kit-help
p11-kit-trust
p11-kit (Red Hat package)
Red Hat OpenShift Serverless
Windows Container Support for Red Hat OpenShift
OpenShift Virtualization
VMware Tanzu Operations Manager
Service Telemetry Framework
Dell Secure Connect Gateway
Isolation Segment
VMware Tanzu Application Service for VMs
Migration Toolkit for Containers
Cloud Pak for Security (CP4S)
Red Hat OpenShift Jaeger
WordPress Gallery Plugin - NextGEN Gallery
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Storage
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
Slackware Linux
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
Ubuntu
openEuler
Web Terminal
Dell EMC NetWorker vProxy

Install updates from vendor's website.

p11-kit - update to 0.23.22
p11-kit (Alpine package) - update to 0.23.22-r0
p11-kit (Debian package) - update to 0.23.15-2+deb10u1
Red Hat OpenShift Serverless - update to 1.16.0
Migration Toolkit for Containers - update to 1.7.3
Cloud Pak for Security (CP4S) - update to 1.8.0.0
Red Hat OpenShift Jaeger - addressed in versions 1.17.9, 1.20.4
Windows Container Support for Red Hat OpenShift - update to 2.0.1
Dell Secure Connect Gateway - update to 5.14.00.10
p11-kit-modules (Ubuntu package) - addressed in versions 0.23.2-5~ubuntu16.04.2, 0.23.9-2ubuntu0.1, 0.23.20-1ubuntu0.1, 0.23.21-2ubuntu0.1
p11-kit (Ubuntu package) - addressed in versions 0.23.2-5~ubuntu16.04.2, 0.23.9-2ubuntu0.1, 0.23.20-1ubuntu0.1, 0.23.21-2ubuntu0.1
libp11-kit0 (Ubuntu package) - addressed in versions 0.23.2-5~ubuntu16.04.2, 0.23.9-2ubuntu0.1, 0.23.20-1ubuntu0.1, 0.23.21-2ubuntu0.1
p11-kit-debuginfo-32bit - update to 0.23.2-8.10.1
p11-kit-debuginfo - addressed in versions 0.23.2-8.10.1, 0.23.2-150000.4.16.1
p11-kit-debugsource - addressed in versions 0.23.2-8.10.1, 0.23.2-150000.4.16.1
p11-kit-devel - addressed in versions 0.23.2-8.10.1, 0.23.2-150000.4.16.1
libp11-kit0 - addressed in versions 0.23.2-8.10.1, 0.23.2-150000.4.16.1
libp11-kit0-debuginfo - addressed in versions 0.23.2-8.10.1, 0.23.2-150000.4.16.1
p11-kit-nss-trust - addressed in versions 0.23.2-8.10.1, 0.23.2-150000.4.16.1
p11-kit-tools - addressed in versions 0.23.2-8.10.1, 0.23.2-150000.4.16.1
p11-kit-tools-debuginfo - addressed in versions 0.23.2-8.10.1, 0.23.2-150000.4.16.1
libp11-kit0-32bit - addressed in versions 0.23.2-8.10.1, 0.23.2-150000.4.16.1
p11-kit-32bit - addressed in versions 0.23.2-8.10.1, 0.23.2-150000.4.16.1
libp11-kit0-debuginfo-32bit - update to 0.23.2-8.10.1
p11-kit - addressed in versions 0.23.2-8.10.1, 0.23.2-150000.4.16.1
libp11-kit0-32bit-debuginfo - update to 0.23.2-150000.4.16.1
p11-kit-32bit-debuginfo - update to 0.23.2-150000.4.16.1
p11-kit-nss-trust-32bit - update to 0.23.2-150000.4.16.1
p11-kit - update to 0.23.20-2
p11-kit-debuginfo - update to 0.23.20-2
p11-kit-debugsource - update to 0.23.20-2
p11-kit-devel - update to 0.23.20-2
p11-kit-help - update to 0.23.20-2
p11-kit-trust - update to 0.23.20-2
p11-kit (Red Hat package) - update to 0.23.22-1.el8
Web Terminal - update to 1.3
Tanzu Greenplum for Kubernetes - update to 2.0.0
IBM Watson Machine Learning Accelerator - update to 2.3.9
OpenShift Virtualization - addressed in versions 2.6.6, 4.8.0
VMware Tanzu Operations Manager - addressed in versions 2.7.28, 2.9.16, 2.10.5
Isolation Segment - addressed in versions 2.7.30, 2.8.24, 2.9.18, 2.10.10
VMware Tanzu Application Service for VMs - addressed in versions 2.7.31, 2.8.25, 2.9.19, 2.10.11
Dell EMC NetWorker vProxy - update to 4.3.0-36
Platform Automation Toolkit - addressed in versions 4.4.18, 5.0.12

• https://github.com/p11-glue/p11-kit/releases/tag/0.23.22

• Multiple vulnerabilities in FreeDesktop p11-kit
• Slackware Linux update for p11-kit
• Buffer overflow in p11-kit (Alpine package)
• Debian update for p11-kit
• Multiple vulnerabilities in VMware Tanzu Products
• Red Hat Enterprise Linux 8 update for p11-kit
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in Windows Container Support for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in OpenShift Serverless
• Multiple vulnerabilities in Red Hat Web Terminal
• Ubuntu update for p11-kit
• SUSE update for p11-kit
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in Red Hat Service Telemetry Framework
• Multiple vulnerabilities in IBM Cloud Pak for Security
• SUSE update for p11-kit
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in Dell EMC Data Protection Central
• Multiple vulnerabilities in Dell NetWorker vProxy
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• openEuler update for p11-kit
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Multiple vulnerabilities in OpenShift Virtualization 2.6