Buffer overflow in p11-kit - CVE-2020-29363

Vulnerability identifier: #VU48946

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-29363

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a unspecified boundary error, related to processing of RPC requests. A remote attacker can perform a denial of service (DoS) attack.

p11-kit
Tanzu Greenplum for Kubernetes
IBM Watson Machine Learning Accelerator
Platform Automation Toolkit
p11-kit (Alpine package)
p11-kit (Debian package)
libp11-kit0 (Ubuntu package)
p11-kit (Ubuntu package)
p11-kit-modules (Ubuntu package)
p11-kit
p11-kit-debuginfo
p11-kit-debugsource
p11-kit-devel
p11-kit-help
p11-kit-trust
p11-kit (Red Hat package)
Red Hat OpenShift Serverless
Windows Container Support for Red Hat OpenShift
OpenShift Virtualization
VMware Tanzu Operations Manager
Service Telemetry Framework
Isolation Segment
VMware Tanzu Application Service for VMs
Cloud Pak for Security (CP4S)
Migration Toolkit for Containers
Oracle Communications Cloud Native Core Policy
Red Hat OpenShift Jaeger
WordPress Gallery Plugin - NextGEN Gallery
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Slackware Linux
Ubuntu
openEuler
Web Terminal

Install updates from vendor's website.

p11-kit - update to 0.23.22
p11-kit (Alpine package) - update to 0.23.22-r0
p11-kit (Debian package) - update to 0.23.15-2+deb10u1
Red Hat OpenShift Serverless - update to 1.16.0
Cloud Pak for Security (CP4S) - update to 1.8.0.0
Migration Toolkit for Containers - update to 1.7.3
Red Hat OpenShift Jaeger - addressed in versions 1.17.9, 1.20.4
Windows Container Support for Red Hat OpenShift - update to 2.0.1
libp11-kit0 (Ubuntu package) - addressed in versions 0.23.2-5~ubuntu16.04.2, 0.23.9-2ubuntu0.1, 0.23.20-1ubuntu0.1, 0.23.21-2ubuntu0.1
p11-kit (Ubuntu package) - addressed in versions 0.23.2-5~ubuntu16.04.2, 0.23.9-2ubuntu0.1, 0.23.20-1ubuntu0.1, 0.23.21-2ubuntu0.1
p11-kit-modules (Ubuntu package) - addressed in versions 0.23.2-5~ubuntu16.04.2, 0.23.9-2ubuntu0.1, 0.23.20-1ubuntu0.1, 0.23.21-2ubuntu0.1
p11-kit - update to 0.23.20-2
p11-kit-debuginfo - update to 0.23.20-2
p11-kit-debugsource - update to 0.23.20-2
p11-kit-devel - update to 0.23.20-2
p11-kit-help - update to 0.23.20-2
p11-kit-trust - update to 0.23.20-2
p11-kit (Red Hat package) - update to 0.23.22-1.el8
Web Terminal - update to 1.3
Tanzu Greenplum for Kubernetes - update to 2.0.0
IBM Watson Machine Learning Accelerator - update to 2.3.9
OpenShift Virtualization - addressed in versions 2.6.6, 4.8.0
VMware Tanzu Operations Manager - addressed in versions 2.7.28, 2.9.16, 2.10.5
Isolation Segment - addressed in versions 2.7.30, 2.8.24, 2.9.18, 2.10.10
VMware Tanzu Application Service for VMs - addressed in versions 2.7.31, 2.8.25, 2.9.19, 2.10.11
Platform Automation Toolkit - addressed in versions 4.4.18, 5.0.12

• https://github.com/p11-glue/p11-kit/releases/tag/0.23.22

• Multiple vulnerabilities in FreeDesktop p11-kit
• Slackware Linux update for p11-kit
• Buffer overflow in p11-kit (Alpine package)
• Debian update for p11-kit
• Multiple vulnerabilities in VMware Tanzu Products
• Red Hat Enterprise Linux 8 update for p11-kit
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in Windows Container Support for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in OpenShift Serverless
• Multiple vulnerabilities in Red Hat Web Terminal
• Ubuntu update for p11-kit
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in Red Hat Service Telemetry Framework
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• openEuler update for p11-kit
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Multiple vulnerabilities in OpenShift Virtualization 2.6