PT-2019-10991 · Isc · Kea Dhcp

Publicado 2019-01-16 · Atualizado 2019-10-09 · CVE-2018-5739

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Kea DHCP version 1.4.0

Description: A memory leak issue affects operators using certain hooks library facilities, specifically those that utilize query4 or query6 parameters in their callouts. This leak results from the improper freeing of memory in the callout handle store, introduced to support multiple requests simultaneously. The issue leads to the exhaustion of available memory and the subsequent failure of the server process.

Recommendations: For Kea DHCP version 1.4.0, consider disabling hooks that use query4 or query6 parameters in their callouts as a temporary workaround to prevent memory leaks. Restrict access to these hooks to minimize the risk of exploitation until a proper fix is available.

Correção

Missing Release of Resource after Effective Lifetime

Enumeração de Fraquezas

CWE-772

Identificadores relacionados

CVE-2018-5739

Produtos afetados

Kea Dhcp

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-5739 · Aviso do Fabricante
• https://kb.isc.org/docs/aa-01626 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-5739 · Nota de Segurança