Resource exhaustion in XZ Utils - CVE-2020-22916

Vulnerability identifier: #VU88539

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-22916

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when decompressing files. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

XZ Utils
APEX Cloud Platform for Microsoft Azure
Storage Resource Manager
APEX Cloud Platform for Red Hat OpenShift
Juniper Cloud Native Router
Dell EMC Storage Monitoring and Reporting (SMR)
Junos cRPD

Install update from vendor's website.

XZ Utils - update to 5.2.6
APEX Cloud Platform for Microsoft Azure - update to 01.04.01.00
APEX Cloud Platform for Red Hat OpenShift - update to 03.04.01.00
Storage Resource Manager - update to 5.0.2.2
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.2.2
Juniper Cloud Native Router - update to 23.4R1
Junos cRPD - update to 23.4R1

• https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability
• https://github.com/tukaani-project/xz/issues/61
• https://bugzilla.redhat.com/show_bug.cgi?id=2234987
• https://bugzilla.suse.com/show_bug.cgi?id=1214590
• https://security-tracker.debian.org/tracker/CVE-2020-22916
• http://web.archive.org/web/20230918084612/

• Denial of service in XZ Utils
• Multiple vulnerabilities in Juniper Cloud Native Router
• Multiple vulnerabilities in Juniper Networks Junos cRPD
• Dell APEX Cloud Platform for Microsoft Azure update for third-party components
• Dell APEX Cloud Platform for Red Hat OpenShift update for third-party components
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)