Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-20389 State: PUBLISHED Published: 2020-05-15T17:02:59 Last Updated: 2024-08-05T02:39:09.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the v[language_switch] parameter (within multipart/form-data), which is reflected back within a user's browser without proper output encoding. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/157699/Subrion-CMS-4.2.1-Cross-Site-Scripting.html
CVE ID: CVE-2019-20390 State: PUBLISHED Published: 2020-05-15T17:07:56 Last Updated: 2024-08-05T02:39:09.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge, by enticing an authenticated user to visit an attacker's web page. The application fails to validate the CSRF token for a GET request. An attacker can craft a panel/uploads/read.json?cmd=rm URL (removing this token) and send it to the victim. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/157700/Sub
victim. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/157700/Subrion-CMS-4.2.1-Cross-Site-Request-Forgery.html
CVE ID: CVE-2019-20391 State: PUBLISHED Published: 2020-01-22T00:00:00 Last Updated: 2024-08-05T02:39:09.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CESNET/libyang/commit/bdb596ddc07596fa212f231135b87d0b9178f6f8 - https://github.com/CESNET/libyang/issues/772 - https://bugzilla.redhat.com/show_bug.cgi?id=1793934 - https://github.com/CESNET/libyang/compare/v1.0
ibyang/issues/772 - https://bugzilla.redhat.com/show_bug.cgi?id=1793934 - https://github.com/CESNET/libyang/compare/v1.0-r2...v1.0-r3 - https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html
CVE ID: CVE-2019-20392 State: PUBLISHED Published: 2020-01-22T00:00:00 Last Updated: 2024-08-05T02:39:09.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CESNET/libyang/commit/32fb4993bc8bb49e93e84016af3c10ea53964be5 - https://github.com/CESNET/libyang/issues/723 - https://bugzilla.redhat.com/show_bug.cgi?id=1793922 -
6af3c10ea53964be5 - https://github.com/CESNET/libyang/issues/723 - https://bugzilla.redhat.com/show_bug.cgi?id=1793922 - https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1 - https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html
CVE ID: CVE-2019-20393 State: PUBLISHED Published: 2020-01-22T00:00:00 Last Updated: 2024-08-05T02:39:09.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1 - https://github.com/CESNET/libyang/issues/742 - https://github.com/CESNET/libyang/commit/d9feacc4a590d35dbc1af21caf9080008b4450ed - https
om/CESNET/libyang/issues/742 - https://github.com/CESNET/libyang/commit/d9feacc4a590d35dbc1af21caf9080008b4450ed - https://bugzilla.redhat.com/show_bug.cgi?id=1793930 - https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html
CVE ID: CVE-2019-20394 State: PUBLISHED Published: 2020-01-22T00:00:00 Last Updated: 2024-08-05T02:39:09.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CESNET/libyang/compare/v1.0-r2...v1.0-r3 - https://github.com/CESNET/libyang/issues/769 - https://github.com/CESNET/libyang/commit/6cc51b1757dfbb7cff92de074
0-r3 - https://github.com/CESNET/libyang/issues/769 - https://github.com/CESNET/libyang/commit/6cc51b1757dfbb7cff92de074ada65e8523289a6 - https://bugzilla.redhat.com/show_bug.cgi?id=1793932 - https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html
CVE ID: CVE-2019-20395 State: PUBLISHED Published: 2020-01-22T00:00:00 Last Updated: 2024-08-05T02:39:09.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1 - https://github.com/CESNET/libyang/issues/724 - https://github.com/CESNET/libyang/commit/4e610ccd87a2ba9413819777d508f71163fcc237 - https://bugzilla.redhat.com/show_bug.cgi?id=1793924 - https://lists.debi
mmit/4e610ccd87a2ba9413819777d508f71163fcc237 - https://bugzilla.redhat.com/show_bug.cgi?id=1793924 - https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html
CVE ID: CVE-2019-20396 State: PUBLISHED Published: 2020-01-22T00:00:00 Last Updated: 2024-08-05T02:39:09.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1 - https://github.com/CESNET/libyang/issues/740 - https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8 - https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html
CVE ID: CVE-2019-20397 State: PUBLISHED Published: 2020-01-22T00:00:00 Last Updated: 2024-08-05T02:39:09.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1 - https://github.com/CESNET/libyang/issues/739 - https://github.com/CESNET/libyang/commit/88bd6c548ba79bce176cd875e9b56e7e0ef4d
://github.com/CESNET/libyang/issues/739 - https://github.com/CESNET/libyang/commit/88bd6c548ba79bce176cd875e9b56e7e0ef4d8d4 - https://bugzilla.redhat.com/show_bug.cgi?id=1793928 - https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html
CVE ID: CVE-2019-20398 State: PUBLISHED Published: 2020-01-22T00:00:00 Last Updated: 2024-08-05T02:39:09.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup(). Applications that use libyang to parse untrusted input yang files may crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CESNET/libyang/compare/v1.0-r2...v1.0-r3 - https://github.com/CESNET/libyang/commit/7852b272ef77f8098c35deea6c6f09cb78176f08 - https://github.com/CESNET/libyang/issues/773 - https://bugzilla.redhat.co
mit/7852b272ef77f8098c35deea6c6f09cb78176f08 - https://github.com/CESNET/libyang/issues/773 - https://bugzilla.redhat.com/show_bug.cgi?id=1793935 - https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html
CVE ID: CVE-2019-20399 State: PUBLISHED Published: 2020-01-22T23:12:33 Last Updated: 2024-08-05T02:39:09.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/paritytech/libsecp256k1/commit/11ba23a9766a5079918cd9f515bc100bc8164b50
CVE ID: CVE-2019-20400 State: PUBLISHED Published: 2020-02-06T03:10:26.194619Z Last Updated: 2024-09-16T22:56:20.197Z Vendors: Atlassian Products: Jira Server Problem Types: DLL Hijacking Description: The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental variable can inject code into via a DLL hijacking vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70407
CVE ID: CVE-2019-20401 State: PUBLISHED Published: 2020-02-06T03:10:26.692612Z Last Updated: 2024-09-16T16:23:36.710Z Vendors: Atlassian Products: Jira Server Problem Types: Cross-Site Request Forgery (CSRF) Description: Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery (CSRF) vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70406
CVE ID: CVE-2019-20402 State: PUBLISHED Published: 2020-02-06T03:10:27.208558Z Last Updated: 2024-09-16T18:29:43.223Z Vendors: Atlassian Products: Jira Server Problem Types: Improper Authorization Description: Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70564
CVE ID: CVE-2019-20403 State: PUBLISHED Published: 2020-02-06T03:10:27.629383Z Last Updated: 2024-09-16T23:06:45.923Z Vendors: Atlassian Products: Jira Server Problem Types: Information Disclosure Description: The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70565
CVE ID: CVE-2019-20404 State: PUBLISHED Published: 2020-02-06T03:10:28.034241Z Last Updated: 2024-09-16T17:43:28.548Z Vendors: Atlassian Products: Jira Server Problem Types: Improper Authorization Description: The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70569
CVE ID: CVE-2019-20405 State: PUBLISHED Published: 2020-02-06T03:10:28.440147Z Last Updated: 2024-09-16T22:08:46.030Z Vendors: Atlassian Products: Jira Server Problem Types: Cross Site Scripting (CSRF) Description: The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a Cross-site request forgery (CSRF) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70570
CVE ID: CVE-2019-20406 State: PUBLISHED Published: 2020-02-06T03:10:28.891775Z Last Updated: 2024-09-16T23:21:49.035Z Vendors: Atlassian Products: Confluence Data Center Problem Types: DLL Hijacking Description: The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a DLL file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CONFSERVER-59428
CVE ID: CVE-2019-20407 State: PUBLISHED Published: 2020-03-17T03:10:12.407195Z Last Updated: 2024-09-17T00:42:17.794Z Vendors: Atlassian Products: Jira Software Problem Types: Improper Authorization Description: The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70599
CVE ID: CVE-2019-20408 State: PUBLISHED Published: 2020-07-01T01:35:24.899286Z Last Updated: 2024-09-16T17:54:00.591Z Vendors: Atlassian Products: Jira Server Problem Types: Server Side Request Forgery (SSRF) Description: The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-71204
CVE ID: CVE-2019-20409 State: PUBLISHED Published: 2020-06-23T05:55:10.632452Z Last Updated: 2024-09-17T02:26:56.721Z Vendors: Atlassian Products: Jira Server Problem Types: Remote Code Execution Description: The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70944
CVE ID: CVE-2019-20410 State: PUBLISHED Published: 2020-06-29T05:20:11.941519Z Last Updated: 2024-09-17T02:16:07.001Z Vendors: Atlassian Products: Jira Server Problem Types: Information Disclosure Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment restriction feature. The affected versions are before version 7.6.17, from version 7.7.0 before 7.13.9, and from version 8.0.0 before 8.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70884
CVE ID: CVE-2019-20411 State: PUBLISHED Published: 2020-06-29T05:30:13.060776Z Last Updated: 2024-09-16T17:43:47.805Z Vendors: Atlassian Products: Jira Server Problem Types: Cross-Site Request Forgery Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70881
CVE ID: CVE-2019-20412 State: PUBLISHED Published: 2020-06-29T05:50:11.692351Z Last Updated: 2024-09-17T00:06:43.084Z Vendors: Atlassian Products: Jira Server Problem Types: Information Disclosure Description: The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper Authentication vulnerability: Workflow names; Project Key, if it is part of the workflow name; Issue Keys; Issue Types; Status Types. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/bro
sion 8.0.0 before 8.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70882
CVE ID: CVE-2019-20413 State: PUBLISHED Published: 2020-06-29T06:05:15.549519Z Last Updated: 2024-09-16T19:41:27.665Z Vendors: Atlassian Products: Jira Server Problem Types: Denial of Service Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability on the UserPickerBrowser.jspa page. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70883
CVE ID: CVE-2019-20414 State: PUBLISHED Published: 2020-06-29T06:15:12.355063Z Last Updated: 2024-09-16T22:51:46.551Z Vendors: Atlassian Products: Jira Server Problem Types: Cross-Site Scripting Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in Issue Navigator Basic Search. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70885
CVE ID: CVE-2019-20415 State: PUBLISHED Published: 2020-06-30T02:50:11.721214Z Last Updated: 2024-09-17T00:51:17.879Z Vendors: Atlassian Products: Jira Server Problem Types: Cross-Site Request Forgery Description: Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.3, and from version 8.0.0 before 8.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70849
CVE ID: CVE-2019-20416 State: PUBLISHED Published: 2020-06-30T03:00:15.866051Z Last Updated: 2024-09-17T04:14:48.623Z Vendors: Atlassian Products: Jira Server Problem Types: Cross-Site Scripting Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the project configuration feature. The affected versions are before version 8.3.0. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70856
CVE ID: CVE-2019-20417 State: REJECTED Published: N/A Last Updated: 2022-11-21T00:00:00 Description: No description available.
CVE ID: CVE-2019-20418 State: PUBLISHED Published: 2020-07-03T01:05:13.223838Z Last Updated: 2024-09-16T18:19:35.652Z Vendors: Atlassian Products: Jira Server Problem Types: Application Denial of Service Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Application Denial of Service vulnerability in the /rendering/wiki endpoint. The affected versions are before version 8.8.0. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70943
CVE ID: CVE-2019-20419 State: PUBLISHED Published: 2020-07-03T01:20:11.452807Z Last Updated: 2024-09-17T03:59:57.356Z Vendors: Atlassian Products: Jira Server Problem Types: DLL Hijacking Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerability in Tomcat. The affected versions are before version 8.5.5, and from version 8.6.0 before 8.7.2. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70945
CVE ID: CVE-2019-20421 State: PUBLISHED Published: 2020-01-27T04:22:10 Last Updated: 2024-08-05T02:39:09.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/1011 - https://github.com/Exiv2/exiv2/commit/a82098f4f90cd86297131b5663c3dec6a34470e8 - https://usn.ubuntu.com/4270-1/ - https://www.debian.org/security/2021/dsa-4958 - https://lists.de
1b5663c3dec6a34470e8 - https://usn.ubuntu.com/4270-1/ - https://www.debian.org/security/2021/dsa-4958 - https://lists.debian.org/debian-lts-announce/2021/08/msg00028.html
CVE ID: CVE-2019-20422 State: PUBLISHED Published: 2020-01-27T04:21:55 Last Updated: 2024-08-05T02:39:09.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.3.4, fib6_rule_lookup in net/ipv6/ip6_fib.c mishandles the RT6_LOOKUP_F_DST_NOREF flag in a reference-count decision, leading to (for example) a crash that was identified by syzkaller, aka CID-7b09c2d052db. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.4 - https://github.com/torvalds/linux/commit/7b09c2d052db4b4ad0b27b97918b46a7746966fa - https://security.netapp.com/advisory/ntap-20200313-0003/
CVE ID: CVE-2019-20423 State: PUBLISHED Published: 2020-01-27T04:21:40 Last Updated: 2024-08-05T02:39:09.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic due to the lack of validation for specific fields of packets sent by a client. The function target_handle_connect() mishandles a certain size value when a client connects to a server, because of an integer signedness error. Additional Analyst Notes: - CVE Program Container: References: - https://jira.whamcloud.com/browse/LU-12605 - https://review.whamcloud.com/#/c/35935/ - http://wiki.lustre.org/Lustre_2.12.3_Changelog - http://lustre.o
se/LU-12605 - https://review.whamcloud.com/#/c/35935/ - http://wiki.lustre.org/Lustre_2.12.3_Changelog - http://lustre.org/
CVE ID: CVE-2019-20424 State: PUBLISHED Published: 2020-01-27T04:21:30 Last Updated: 2024-08-05T02:39:09.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Lustre file system before 2.12.3, mdt_object_remote in the mdt module has a NULL pointer dereference and panic due to the lack of validation for specific fields of packets sent by a client. Additional Analyst Notes: - CVE Program Container: References: - http://wiki.lustre.org/Lustre_2.12.3_Changelog - http://lustre.org/ - https://jira.whamcloud.com/browse/LU-12615 - https://review.whamcloud.com/#/c/35869/
CVE ID: CVE-2019-20425 State: PUBLISHED Published: 2020-01-27T04:21:15 Last Updated: 2024-08-05T02:39:09.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of validation for specific fields of packets sent by a client. In the function lustre_msg_string, there is no validation of a certain length value derived from lustre_msg_buflen_v2. Additional Analyst Notes: - CVE Program Container: References: - http://wiki.lustre.org/Lustre_2.12.3_Changelog - http://lustre.org/ - https://jira.whamcloud.com/browse/LU-12613 - https://review.whamcloud.com/#/c/36209/