Out-of-bounds Read Affecting libguestfs-rsync package, versions <1:1.40.2-28.0.1.module+el8.5.0+20482+a450964e
Threat Intelligence
EPSS
0.35% (72nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ORACLE8-LIBGUESTFSRSYNC-2582550
- published 10 Apr 2022
- disclosed 26 Nov 2020
Introduced: 26 Nov 2020
CVE-2020-29129 Open this link in a new tabHow to fix?
Upgrade Oracle:8 libguestfs-rsync to version 1:1.40.2-28.0.1.module+el8.5.0+20482+a450964e or higher.
This issue was patched in ELSA-2022-9172.
NVD Description
Note: Versions mentioned in the description apply only to the upstream libguestfs-rsync package and not the libguestfs-rsync package as distributed by Oracle.
See How to fix? for Oracle:8 relevant fixed versions and status.
ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.
References
- https://linux.oracle.com/cve/CVE-2020-29129.html
- https://linux.oracle.com/errata/ELSA-2021-1762.html
- https://linux.oracle.com/errata/ELSA-2021-9638.html
- https://linux.oracle.com/errata/ELSA-2022-9172.html
- https://lists.freedesktop.org/archives/slirp/2020-November/000115.html
- http://www.openwall.com/lists/oss-security/2020/11/27/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/45S5IHSWYITJKMRT23HCHJQDI674AMTQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPCOHDEONMHH6QPJZKRLLCNRGRYODG7X/
- https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45S5IHSWYITJKMRT23HCHJQDI674AMTQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPCOHDEONMHH6QPJZKRLLCNRGRYODG7X/
CVSS Scores
version 3.1