PT-2020-15177 · Apache · Apache Nuttx

Published 2020-05-12 · Updated 2020-05-19 · CVE-2020-1939

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache NuttX (Incubating) versions 6.15 through 8.2

Description The issue is related to a NULL pointer dereference bug in the ftpd component of the optional "apps" repository. The NuttX RTOS itself is not affected. Only users who have enabled ftpd in the optional apps repository are impacted.

Recommendations For versions 6.15 through 8.2, consider disabling the ftpd component as a temporary workaround until a patch is available. Restrict access to the ftpd service to minimize the risk of exploitation.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2020-1939

Affected Products

Apache Nuttx

References · 4

• https://osv.dev/vulnerability/CVE-2020-1939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1939 · Security Note
• https://lists.apache.org/thread.html/re3adc65ff4d8d9c34e5bccba3941a28cbb0a47191c150df2727e101d%40%3Cdev.nuttx.apache.org%3E · Patch
• https://t.me/cvenotify/3703 · Telegram Post