3.7

CVE-2019-14850

Exploit

A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nbdkit Project ≫ Nbdkit Version < 1.12.7
Nbdkit Project ≫ Nbdkit Version >= 1.14.0 < 1.14.1
Nbdkit Project ≫ Nbdkit Version >= 1.15.0 < 1.15.1
Redhat ≫ Virtualization Version4.0
Redhat ≫ Enterprise Linux Version8.0
Redhat ≫ Enterprise Linux Version8.0 SwEditionadvanced_virtualization
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.4% 0.595
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 3.7 2.2 1.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
nvd@nist.gov 2.6 4.9 2.9
AV:N/AC:H/Au:N/C:N/I:N/A:P
CWE-406 Insufficient Control of Network Message Volume (Network Amplification)

The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.

https://bugzilla.redhat.com/show_bug.cgi?id=1757258
Patch
Third Party Advisory
Issue Tracking