PT-2020-6526 · Genivia · Gsoap

Published 2020-11-05 · Updated 2024-03-01 · CVE-2020-13577

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Genivia gSOAP version 2.8.107

Description A denial-of-service issue exists in the WS-Security plugin functionality of Genivia gSOAP. This is due to pointer dereference errors when processing SOAP requests. An attacker can exploit this by sending specially crafted HTTP requests, leading to denial of service.

Recommendations For Genivia gSOAP version 2.8.107, consider disabling the WS-Security plugin functionality as a temporary workaround until a patch is available. Restrict access to the SOAP request handling module to minimize the risk of exploitation. Avoid using the vulnerable WS-Security plugin until the issue is resolved.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2021-06057

CVE-2020-13577

DLA-3745-1

MGASA-2021-0263

Affected Products

Gsoap

References · 31

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1188 · Exploit
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/SMTJ3SJJ22SFLBLPKFADV7NVBH7UFA23 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-13577 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/SMTJ3SJJ22SFLBLPKFADV7NVBH7UFA23 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0263.html · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JINMAJB4WQASTKTNSPQL3V7YMSYPKIA2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13577 · Security Note
• https://bdu.fstec.ru/vul/2021-06057 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13577 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0263 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3745-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-13577 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13577 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13577 · Security Note
• https://ubuntu.com/security/CVE-2020-13577 · Vendor Advisory