PT-2020-13674 · Znc · Znc

Darthgandalf · Published 2020-06-02 · Updated 2023-01-27 · CVE-2020-13775

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ZNC versions 1.8.0 through 1.8.1-rc1

Description The issue allows authenticated users to trigger an application crash with a NULL pointer dereference if echo-message is not enabled and there is no network. This can be exploited by attackers to cause a denial of service.

Recommendations For ZNC versions 1.8.0 through 1.8.1-rc1, consider enabling echo-message to prevent the application crash. As a temporary workaround, ensure that there is always a network connection available to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2020-13775

MGASA-2020-0316

Affected Products

Znc

References · 18

• https://github.com/znc/znc/commit/d229761821da38d984a9e4098ad96842490dc001 · Patch
• https://github.com/znc/znc/commit/2390ad111bde16a78c98ac44572090b33c3bd2d8 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-13775 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13775 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HS3DWGXLVRROQQA57UIPMDM6XMVEMBRA · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0316.html · Security Note
• https://osv.dev/vulnerability/MGASA-2020-0316 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13775 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13775 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNVBE4T2DRJRQHFRMHYBTN4OSOL6DBHR · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13775 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-13775 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13775 · Security Note
• https://bugs.mageia.org/show_bug.cgi?id=26886 · Note
• https://wiki.znc.in/ChangeLog/1.7.5 · Note