PT-2020-3490 · Canonical+1 · Whoopsie+2
Seong-Joong Kim
·
Published
2020-06-11
·
Updated
2021-09-13
·
CVE-2020-11937
CVSS v3.1
6.2
Medium
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
whoopsie versions prior to 0.2.52.5ubuntu0.5
whoopsie versions prior to 0.2.62ubuntu0.5
whoopsie versions prior to 0.2.69ubuntu0.1
Description
The issue is related to the
parse report() function in the whoopsie error registration service, which can cause a denial of service due to resource exhaustion resulting from a memory leak. This can be exploited by a local attacker using a crafted file.Recommendations
For versions prior to 0.2.52.5ubuntu0.5, update to version 0.2.52.5ubuntu0.5 or later.
For versions prior to 0.2.62ubuntu0.5, update to version 0.2.62ubuntu0.5 or later.
For versions prior to 0.2.69ubuntu0.1, update to version 0.2.69ubuntu0.1 or later.
As a temporary workaround, consider disabling the
parse report() function until a patch is available.Exploit
Fix
DoS
Memory Leak
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Ubuntu
Whoopsie