PT-2020-16185 · Cesanta · Mongoose

Bushraalorainio · Published 2020-09-18 · Updated 2024-08-04 · CVE-2020-25756

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose version 6.18

Description A buffer overflow issue exists in the mg get http header function due to a lack of bounds checking, which can be exploited by a crafted HTTP header.

Recommendations For Cesanta Mongoose version 6.18, consider applying bounds checking to the mg get http header function to prevent buffer overflow exploitation. As a temporary workaround, restrict the use of crafted HTTP headers until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2020-25756

Affected Products

Mongoose

References · 7

• https://github.com/cesanta/mongoose/issues/1135 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-25756 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-25756 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-25756 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25756 · Vendor Advisory
• https://t.me/cvenotify/84561 · Telegram Post
• https://t.me/cvenotify/89018 · Telegram Post