Reachable Assertion in privoxy - CVE-2021-20272
Published: February 28, 2021 / Updated: March 6, 2021
Vulnerability identifier: #VU50973
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-20272
CWE-ID: CWE-617
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion within the ssplit() function when processing CGI requests. A remote attacker can send a specially crafted CGI request, trigger an assertion failure and crash the service.
Affected software
privoxy
Gentoo Linux
Ubuntu
privoxy (Ubuntu package)
Gentoo Linux
Ubuntu
privoxy (Ubuntu package)
How to mitigate CVE-2021-20272
Install updates from vendor's website.
privoxy - update to 3.0.32
privoxy (Ubuntu package) - addressed in versions 3.0.24-1ubuntu0.1, 3.0.26-5ubuntu0.1, 3.0.28-2ubuntu0.1, 3.0.28-3ubuntu0.1
privoxy (Ubuntu package) - addressed in versions 3.0.24-1ubuntu0.1, 3.0.26-5ubuntu0.1, 3.0.28-2ubuntu0.1, 3.0.28-3ubuntu0.1