7.5
CVE-2020-11612
- EPSS 1.85%
- Published 07.04.2020 18:15:13
- Last modified 21.11.2024 04:58:14
- Source cve@mitre.org
- Teams watchlist Login
- Open Login
The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.
Data is provided by the National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version9.0
Debian ≫ Debian Linux Version10.0
Fedoraproject ≫ Fedora Version33
Netapp ≫ Oncommand Api Services Version-
Netapp ≫ Oncommand Insight Version-
Netapp ≫ Oncommand Workflow Automation Version-
Oracle ≫ Communications Brm - Elastic Charging Engine Version12.0.0.3
Oracle ≫ Communications Design Studio Version7.4.2
Oracle ≫ Nosql Database Version < 20.3
Oracle ≫ Siebel Core - Server Framework Version < 21.5
Oracle ≫ Webcenter Portal Version12.2.1.3.0
Oracle ≫ Webcenter Portal Version12.2.1.4.0
Oracle ≫ Communications Messaging Server Version8.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.85% | 0.813 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
CWE-770 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.