PT-2020-13290 · Alvaro Lopez Ortega · Cherokee

Pjlantz · Published 2020-07-27 · Updated 2022-11-29 · CVE-2020-12845

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cherokee versions 0.4.27 through 1.2.104

Description The issue is a denial of service caused by NULL pointer dereferences. A remote unauthenticated attacker can crash the server by sending an HTTP request to protected resources using a malformed Authorization header. This header is mishandled during a cherokee buffer add call within cherokee validator parse basic or cherokee validator parse digest functions.

Recommendations For Cherokee versions 0.4.27 through 1.2.104, as a temporary workaround, consider restricting access to protected resources to minimize the risk of exploitation. Avoid using malformed Authorization headers in HTTP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2020-12845

MGASA-2021-0019

Affected Products

Cherokee

References · 10

• 🔥 https://github.com/cherokee/webserver/issues/1242 · Exploit
• https://security.gentoo.org/glsa/202012-09 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0019.html · Security Note
• http://cherokee-project.com/downloads.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12845 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12845 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0019 · Vendor Advisory
• https://github.com/cherokee/webserver/releases · Note
• https://bugs.mageia.org/show_bug.cgi?id=27736 · Note
• https://t.me/cvenotify/7664 · Telegram Post