PT-2020-17143 · Blosc+1 · C-Blosc2+1

Nmoinvaz · Published 2020-11-27 · Updated 2025-04-25 · CVE-2020-29367

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Blosc C-Blosc2 versions through 2.0.0.beta.5

Description The issue arises from a heap-based buffer overflow in the blosc2.c file when there is insufficient space to write compressed data.

Recommendations For versions through 2.0.0.beta.5, consider updating to a newer version that addresses this issue, as using the current version may pose a risk due to the heap-based buffer overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-29367

GHSA-8C7C-2C8J-3XFP

MGASA-2021-0051

OPENSUSE-SU-2020:2337-1

OPENSUSE-SU-2020_2337-1

OPENSUSE-SU-2024:10655-1

PYSEC-2020-343

Affected Products

C-Blosc2

Suse

References · 19

• https://github.com/Blosc/c-blosc2/commit/c4c6470e88210afc95262c8b9fcc27e30ca043ee · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2020:2337-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-343 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8c7c-2c8j-3xfp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-29367 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0051 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29367 · Security Note
• https://advisories.mageia.org/MGASA-2021-0051.html · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/blosc2/PYSEC-2020-343.yaml · Note
• https://github.com/Blosc/python-blosc2 · Note
• https://github.com/Blosc/python-blosc2/releases/tag/v0.1.7 · Note
• https://bugzilla.suse.com/1179914 · Note
• https://t.me/cvenotify/119818 · Telegram Post
• https://github.com/advisories/GHSA-8c7c-2c8j-3xfp · Note
• https://suse.com/security/cve/CVE-2020-29367 · Note