CVE-2019-20918

An issue was discovered in InspIRCd 3 before 3.1.0. The silence module contains a use after free vulnerability. This vulnerability can be used for remote crashing of an InspIRCd server by any user able to fully connect to a server.

CVSS v3 6.5 MEDIUM
CVSS v2.0 6.8 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:C

Exploitability : 8.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
https://docs.inspircd.org/security/2019-01/	Vendor Advisory
https://github.com/inspircd/inspircd/commit/7b47de3c194f239c5fea09a0e49696c9af017d51	Patch Third Party Advisory
https://github.com/inspircd/inspircd/commit/bcd65de1ec4bb71591ae417fee649d7ecd37cd57	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:inspircd:inspircd:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-09-11 05:15

Updated : 2023-12-10 13:27

NVD link : CVE-2019-20918

Mitre link : CVE-2019-20918

CVE.ORG link : CVE-2019-20918

JSON object : View

Products Affected

inspircd

inspircd

CWE

CWE-416

Use After Free

{"id": "CVE-2019-20918", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:C", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2020-09-11T05:15:12.543", "references": [{"url": "https://docs.inspircd.org/security/2019-01/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/inspircd/inspircd/commit/7b47de3c194f239c5fea09a0e49696c9af017d51", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/inspircd/inspircd/commit/bcd65de1ec4bb71591ae417fee649d7ecd37cd57", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in InspIRCd 3 before 3.1.0. The silence module contains a use after free vulnerability. This vulnerability can be used for remote crashing of an InspIRCd server by any user able to fully connect to a server."}, {"lang": "es", "value": "Se detect\u00f3 un problema en InspIRCd versiones 3 anteriores a 3.1.0. El m\u00f3dulo silence contiene una vulnerabilidad de uso de la memoria previamente liberada. Esta vulnerabilidad puede ser usada para el bloqueo remoto de un servidor de InspIRCd por cualquier usuario que pueda conectarse completamente a un servidor"}], "lastModified": "2020-09-15T14:33:10.983", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:inspircd:inspircd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7252B02-D3A7-4A49-B75C-5AE808A062D0", "versionEndExcluding": "3.1.0", "versionStartIncluding": "3.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}