PT-2020-19793 · I18N · I18N

Chris Stephens · Published 2020-12-11 · Updated 2022-09-02 · CVE-2020-7791

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions i18n versions prior to 2.1.15

Description The issue arises from insufficient handling of erroneous language tags in the files src/i18n/Concrete/TextLocalizer.cs and src/i18n/LocalizedApplication.cs. This results in a vulnerability that affects the package i18n.

Recommendations For versions prior to 2.1.15, update to version 2.1.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the TextLocalizer.cs and LocalizedApplication.cs files until a patch is applied. Avoid using erroneous language tags in the affected files to minimize the risk of exploitation.

Fix

RCE

Resource Exhaustion

Weakness Enumeration

CWE-20

CWE-400

Related Identifiers

CVE-2020-7791

GHSA-HFVC-G252-RP4G

SNYK-DOTNET-I18N-1050179

Affected Products

I18N

References · 35

• https://github.com/turquoiseowl/i18n/commit/c418e3345313dc896c1951d8c46ab0b9b12fcbd3 · Patch
• https://osv.dev/vulnerability/CVE-2020-7791 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7791 · Security Note
• https://osv.dev/vulnerability/GHSA-hfvc-g252-rp4g · Vendor Advisory
• https://github.com/turquoiseowl/i18n/issues/387 · Note
• https://t.me/cibsecurity/20382 · Telegram Post
• https://t.me/cibsecurity/20439 · Telegram Post
• https://lists.apache.org/thread.html/r9744574911e7e4edf5f4eeae92a4ccc83e3723cec937950062bb8775%40%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/r5e08837e695efd36be73510ce58ec05785dbcea077819d8acc2d990d@%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/r1573c58dc283b05f7a40a3f5ff0079b5bbde0492d406ee0fe98d40b6%40%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/ra5047392edf1fecba441c9adc8807ed6c5f7d2cc71f2f3bb89f35371@%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/rc2abba7aa0450198494bbee654fce9b97fad72a4989323e189faede4@%3Cdev.myfaces.apache.org%3E · Note
• https://lists.apache.org/thread.html/r394b1ae54693609a60ea8aab02ff045dc92f593aa3aebff562e69958%40%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/r9744574911e7e4edf5f4eeae92a4ccc83e3723cec937950062bb8775@%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/r1573c58dc283b05f7a40a3f5ff0079b5bbde0492d406ee0fe98d40b6@%3Ccommits.druid.apache.org%3E · Note