PT-2020-6414 · Unknown · Jerryscript

Chong + 1 · Published 2020-06-01 · Updated 2021-06-16 · CVE-2020-23313

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0

Description The issue is related to the scanner literal is created function in the js-scanner-util.c component of the JerryScript JavaScript engine for Internet of Things (IoT). It is caused by insufficient use of the assert() function. Exploitation of this issue may allow a remote attacker to cause a denial of service.

Recommendations For JerryScript version 2.2.0, consider disabling the scanner literal is created function as a temporary workaround until a patch is available. Restrict access to the js-scanner-util.c component to minimize the risk of exploitation. Avoid using the scanner literal is created function in the affected API endpoint until the issue is resolved.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BDU:2021-04634

CVE-2020-23313

Affected Products

Jerryscript

References · 8

• 🔥 https://github.com/jerryscript-project/jerryscript/issues/3823 · Exploit
• https://ubuntu.com/security/CVE-2020-23313 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04634 · Security Note
• https://osv.dev/vulnerability/CVE-2020-23313 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23313 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-23313 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-23313 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-23313 · Vendor Advisory