PT-2019-6268 · Inspircd+4 · Inspircd+4

Sadiecat · Published 2019-08-19 · Updated 2025-04-02 · CVE-2019-20917

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions InspIRCd versions prior to 2.0.28 InspIRCd versions prior to 3.3.0

Description The issue is related to a NULL pointer dereference in the mysql module of InspIRCd when built against mariadb-connector-c 3.0.5 or newer. This can be exploited for remote crashing of an InspIRCd server by any user able to connect to it, particularly when combined with the sqlauth or sqloper modules. The vulnerability is associated with pointer dereference errors, which can allow a remote attacker to cause a denial of service.

Recommendations For InspIRCd versions prior to 2.0.28, update to version 2.0.28 or later. For InspIRCd versions prior to 3.3.0, update to version 3.3.0 or later.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2020-3126

ALT-PU-2020-3171

ALT-PU-2024-11122

BDU:2022-06171

CVE-2019-20917

DLA-2375-1

DSA-4764-1

USN-7405-1

Affected Products

Alt Linux

Inspircd

Linuxmint

Ubuntu

Mariadb Connector/C

References · 19

• https://github.com/inspircd/inspircd/commit/8745660fcdac7c1b80c94cfc0ff60928cd4dd4b7 · Patch
• https://github.com/inspircd/inspircd/commit/2cc35d8625b7ea5cbd1d1ebb116aff86c5280162 · Patch
• https://osv.dev/vulnerability/USN-7405-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06171 · Security Note
• https://osv.dev/vulnerability/DSA-4764-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-20917 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-20917 · Vendor Advisory
• https://docs.inspircd.org/security/2019-02 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-20917 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20917 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-20917 · Security Note
• https://ubuntu.com/security/notices/USN-7405-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20917 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-20917 · Vendor Advisory
• https://debian.org/security/2020/dsa-4764 · Vendor Advisory