HIGH
str2tokbuf used incorrectly by print-someip.c
Published Nov 4, 2020
7.5
HIGHCVSS 3.1
EPSS 1.48%
Description
The tok2strbuf() function in tcpdump 4.10.0-PRE-GIT was used by the SOME/IP dissector in an unsafe way.
Affected products
-
- Version 4.10.0-PRE-GITStatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| The TCPdump Group | Tcpdump | n/a |
|
No data.
Red Hat Enterprise Linux 5
tcpdump
Not affected
Red Hat Enterprise Linux 6
tcpdump
Not affected
Red Hat Enterprise Linux 7
tcpdump
Not affected
Red Hat Enterprise Linux 8
tcpdump
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 5 | tcpdump | Not affected | n/a |
| Red Hat Enterprise Linux 6 | tcpdump | Not affected | n/a |
| Red Hat Enterprise Linux 7 | tcpdump | Not affected | n/a |
| Red Hat Enterprise Linux 8 | tcpdump | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
This issue did not affect the versions of `tcpdump` as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8, as they did not include support for the SOME/IP dissector.
Weaknesses (1)
References (5)
- https://access.redhat.com/security/cve/CVE-2020-8036 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1895075 Issue Tracking
- https://github.com/the-tcpdump-group/tcpdump/commit/e2256b4f2506102be2c6f7976f84f0d607c53d43 x_refsource_MISCPatchThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-8036
- https://www.cve.org/CVERecord?id=CVE-2020-8036
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2020-8036 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1895075 | Issue Tracking | |
| https://github.com/the-tcpdump-group/tcpdump/commit/e2256b4f2506102be2c6f7976f84f0d607c53d43 | x_refsource_MISCPatchThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2020-8036 | ||
| https://www.cve.org/CVERecord?id=CVE-2020-8036 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Tcpdump
Published Nov 4, 2020
Updated Sep 16, 2024
Reserved Jan 27, 2020
Link CVE-2020-8036
CISA Vulnrichment
Updated n/a