PT-2020-16425 · Wireshark+1 · Wireshark+1

Published 2020-12-21 · Updated 2024-06-15 · CVE-2020-26422

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Wireshark versions 3.4.0 through 3.4.1

Description The issue is a buffer overflow in the QUIC dissector, allowing for denial of service via packet injection or crafted capture file.

Recommendations For Wireshark versions 3.4.0 through 3.4.1, consider disabling the QUIC dissector as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2020-26422

OPENSUSE-SU-2021:0909-1

OPENSUSE-SU-2021:2125-1

OPENSUSE-SU-2021_0909-1

OPENSUSE-SU-2021_2125-1

OPENSUSE-SU-2024:11513-1

SUSE-SU-2021:2125-1

Affected Products

Suse

Wireshark

References · 192

• https://osv.dev/vulnerability/CVE-2020-26422 · Vendor Advisory
• https://oracle.com/security-alerts/cpuApr2021.html · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26422 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0909-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26422 · Vendor Advisory
• https://security.gentoo.org/glsa/202101-12 · Vendor Advisory
• https://wireshark.org/security/wnpa-sec-2020-20.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-26422 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:2125-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26422 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11513-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:2125-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2019-16319 · Note
• https://suse.com/security/cve/CVE-2017-9350 · Note
• https://suse.com/security/cve/CVE-2017-13765 · Note