CVE-2019-14851

A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertion failure, causing nbdkit to exit. This issue only affected nbdkit versions 1.12.7, 1.14.1, and 1.15.1.

CVSS v3.0 6.5 MEDIUM
CVSS v2.0 3.5 LOW

6.5^/10

CVSS v3.0 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:N/A:P

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://www.redhat.com/archives/libguestfs/2019-September/msg00272.html	Mailing List Patch Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1757259	Issue Tracking Patch Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nbdkit_project:nbdkit::::::::
	cpe:2.3:a:nbdkit_project:nbdkit::::::::
	cpe:2.3:a:nbdkit_project:nbdkit::::::::

Information

Published : 2021-03-18 13:15

Updated : 2021-03-25 13:03

NVD link : CVE-2019-14851

Mitre link : CVE-2019-14851

JSON object : View

CWE

CWE-617

Reachable Assertion

Advertisement

Products Affected

nbdkit_project

nbdkit

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://www.redhat.com/archives/libguestfs/2019-September/msg00272.html", "name": "https://www.redhat.com/archives/libguestfs/2019-September/msg00272.html", "tags": ["Mailing List", "Patch", "Vendor Advisory"], "refsource": "MISC"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757259", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1757259", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertion failure, causing nbdkit to exit. This issue only affected nbdkit versions 1.12.7, 1.14.1, and 1.15.1."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-617"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2019-14851", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "severity": "LOW", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}}, "publishedDate": "2021-03-18T20:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:nbdkit_project:nbdkit:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.12.7"}, {"cpe23Uri": "cpe:2.3:a:nbdkit_project:nbdkit:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.14.1", "versionStartIncluding": "1.14.0"}, {"cpe23Uri": "cpe:2.3:a:nbdkit_project:nbdkit:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.15.1", "versionStartIncluding": "1.15.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2021-03-25T20:03Z"}