PT-2020-6417 · Unknown · Jerryscript

Owl337 · Published 2020-06-03 · Updated 2021-06-15 · CVE-2020-23320

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0

Description The issue is related to an assertion in the parser parse function arguments function in JerryScript, specifically in the js-parser.c component. This assertion is context p->next scanner info p->type == SCANNER TYPE FUNCTION. The vulnerability is due to insufficient use of the assert() function. Exploitation of this issue could allow a remote attacker to cause a denial of service.

Recommendations For JerryScript version 2.2.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BDU:2021-04637

CVE-2020-23320

Affected Products

Jerryscript

References · 10

• 🔥 https://github.com/jerryscript-project/jerryscript/issues/3835 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2020-23320 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-23320 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23320 · Security Note
• https://osv.dev/vulnerability/CVE-2020-23320 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04637 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-23320 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-23320 · Security Note
• https://github.com/jerryscript-project/jerryscript/pull/3832 · Note
• https://t.me/cvenotify/16130 · Telegram Post