cvelist/2020/10xxx/CVE-2020-10769.json

{
    "data_version": "4.0",
    "data_type": "CVE",
    "data_format": "MITRE",
    "CVE_data_meta": {
        "ID": "CVE-2020-10769",
        "ASSIGNER": "secalert@redhat.com",
        "STATE": "PUBLIC"
    },
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "A buffer over-read flaw was found in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of service."
            }
        ]
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
                        "cweId": "CWE-119"
                    }
                ]
            }
        ]
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "vendor_name": "Red Hat",
                    "product": {
                        "product_data": [
                            {
                                "product_name": "Red Hat Enterprise Linux 7",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_value": "0:3.10.0-1160.11.1.rt56.1145.el7",
                                            "version_affected": "!"
                                        },
                                        {
                                            "version_value": "0:4.14.0-115.29.1.el7a",
                                            "version_affected": "!"
                                        },
                                        {
                                            "version_value": "0:3.10.0-1160.11.1.el7",
                                            "version_affected": "!"
                                        }
                                    ]
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "references": {
        "reference_data": [
            {
                "url": "https://lkml.org/lkml/2019/1/21/675",
                "refsource": "MISC",
                "name": "https://lkml.org/lkml/2019/1/21/675"
            },
            {
                "url": "https://www.oracle.com/security-alerts/cpuApr2021.html",
                "refsource": "MISC",
                "name": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
                "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html",
                "refsource": "MISC",
                "name": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html"
            },
            {
                "url": "https://access.redhat.com/errata/RHSA-2020:3545",
                "refsource": "MISC",
                "name": "https://access.redhat.com/errata/RHSA-2020:3545"
            },
            {
                "url": "https://access.redhat.com/errata/RHSA-2020:5437",
                "refsource": "MISC",
                "name": "https://access.redhat.com/errata/RHSA-2020:5437"
            },
            {
                "url": "https://access.redhat.com/errata/RHSA-2020:5441",
                "refsource": "MISC",
                "name": "https://access.redhat.com/errata/RHSA-2020:5441"
            },
            {
                "url": "https://access.redhat.com/security/cve/CVE-2020-10769",
                "refsource": "MISC",
                "name": "https://access.redhat.com/security/cve/CVE-2020-10769"
            },
            {
                "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1708775",
                "refsource": "MISC",
                "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1708775"
            },
            {
                "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1708775%3B",
                "refsource": "MISC",
                "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1708775%3B"
            }
        ]
    },
    "work_around": [
        {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
    ],
    "impact": {
        "cvss": [
            {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
            }
        ]
    }
}