CRITICAL🇵🇱 Wersja polska

CVE-2020-8443

CVSS 9.8v3.1pub. 2020-01-30upd. 2024-11-21

In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to an off-by-one heap-based buffer overflow during the cleaning of crafted syslog msgs (received from authenticated remote agents and delivered to the analysisd processing queue by ossec-remoted).

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Ossec

    APP
    Ossec
    2.7 – 3.5.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Memory
CWE
References

Related vulnerabilities

CVE-2020-8444CRITICAL9.8PL ✓same product

OSSEC-HIDS: use-after-free w komponencie ossec-analysisd (RCE)

CVE-2020-8447CRITICAL9.8PL ✓same product

OSSEC-HIDS: use-after-free w ossec-analysisd podczas przetwarzania wiadomości syscheck

CVE-2020-8445CRITICAL9.8PL ✓same product

OSSEC-HIDS: Brak walidacji znaków kontrolnych w ossec-analysisd (log injection)

CVE-2021-28040HIGH7.5same product

An issue was discovered in OSSEC 3.6.0. An uncontrolled recursion vulnerability in os_xml.c occurs when a larg...

CVE-2020-8442HIGH8.8same product

In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulner...