Vulnerability Details : CVE-2020-17361
Potential exploit
An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h returns silently when a negative length is provided (instead of throwing an exception). This could result in data being lost during the copy, with varying consequences depending on the subsequent use of the destination buffer. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Products affected by CVE-2020-17361
- cpe:2.3:a:readytalk:avian:1.2.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-17361
0.14%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 50 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-17361
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2020-17361
-
The product does not handle or incorrectly handles an exceptional condition.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-17361
-
http://seclists.org/fulldisclosure/2020/Sep/13
Full Disclosure: Noise-Java AESGCMOnCtrCipherState.encryptWithAd() insufficient boundary checksMailing List;Third Party Advisory
-
http://seclists.org/fulldisclosure/2020/Sep/11
Full Disclosure: Noise-Java AESGCMFallbackCipherState.encryptWithAd() insufficient boundary checksMailing List;Third Party Advisory
-
https://github.com/ReadyTalk/avian/issues
Issues · ReadyTalk/avian · GitHubThird Party Advisory
-
http://seclists.org/fulldisclosure/2020/Aug/10
Full Disclosure: Avian JVM vm::arrayCopy() silent return on negative lengthExploit;Mailing List;Third Party Advisory
-
http://seclists.org/fulldisclosure/2020/Sep/14
Full Disclosure: Noise-Java ChaChaPolyCipherState.encryptWithAd() insufficient boundary checksMailing List;Third Party Advisory
Jump to