Memory leak in privoxy - CVE-2021-20216

Vulnerability identifier: #VU50157

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-20216

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak during decompression. A remote attacker can send specially crafted request to the web server and perform denial of service attack.

privoxy
Arch Linux
Gentoo Linux
Fedora
Ubuntu
privoxy (Ubuntu package)
privoxy

Install updates from vendor's website.

privoxy - update to 3.0.31
privoxy (Ubuntu package) - addressed in versions 3.0.24-1ubuntu0.1, 3.0.26-5ubuntu0.1, 3.0.28-2ubuntu0.1, 3.0.28-3ubuntu0.1
privoxy - addressed in versions 3.0.31-1.el8, 3.0.31-1.fc32, 3.0.31-1.fc33

• http://seclists.org/oss-sec/2021/q1/91
• https://www.privoxy.org/3.0.31/user-manual/whatsnew.html

• Multiple vulnerabilities in Privoxy
• Arch Linux update for privoxy
• Gentoo update for Privoxy
• Ubuntu update for privoxy
• Fedora EPEL 8 update for privoxy
• Fedora 33 update for privoxy
• Fedora 32 update for privoxy