VulnerabilityModified
CVE-2019-20892
net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request.
MEDIUM 6.5EPSS 2.31%
Does this matter?
Lower severity and a low EPSS score (2.31%). Track it; it rarely justifies an emergency change on its own.
Description
net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 2.31% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-415
- Affected
- net-snmp/net-snmp · oracle/zfs storage appliance kit
- Source
- cve@mitre.org
References
- http://www.openwall.com/lists/oss-security/2020/06/25/4Exploit, Mailing List, Third Party Advisory
- https://bugs.launchpad.net/ubuntu/+source/net-snmp/+bug/1877027Exploit, Issue Tracking, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1663027Exploit, Issue Tracking, Third Party Advisory
- https://github.com/net-snmp/net-snmp/commit/5f881d3bf24599b90d67a45cae7a3eb099cd71c9Patch, Third Party Advisory
- https://security.gentoo.org/glsa/202008-12Third Party Advisory
- https://sourceforge.net/p/net-snmp/bugs/2923/Exploit, Third Party Advisory
- https://usn.ubuntu.com/4410-1/Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2020/06/25/4Exploit, Mailing List, Third Party Advisory
- https://bugs.launchpad.net/ubuntu/+source/net-snmp/+bug/1877027Exploit, Issue Tracking, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1663027Exploit, Issue Tracking, Third Party Advisory
- https://github.com/net-snmp/net-snmp/commit/5f881d3bf24599b90d67a45cae7a3eb099cd71c9Patch, Third Party Advisory
- https://security.gentoo.org/glsa/202008-12Third Party Advisory
- https://sourceforge.net/p/net-snmp/bugs/2923/Exploit, Third Party Advisory
- https://usn.ubuntu.com/4410-1/Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.