PT-2020-6592 · Libproxy+5 · Libproxy+5
Mcatanzaro
·
Published
2020-09-07
·
Updated
2024-06-15
·
CVE-2020-25219
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
libproxy versions 0.4.x through 0.4.15
Description
The issue is related to the
url::recvline function in the url.cpp component of the libproxy library, which incorrectly handles the absence of a newline character. This can lead to uncontrolled recursion when a remote HTTP server sends a response composed of an infinite stream lacking a newline character, resulting in stack exhaustion. The vulnerability can be exploited by a remote attacker to cause a denial of service.Recommendations
For libproxy versions 0.4.x through 0.4.15, consider disabling the
url::recvline function in the url.cpp component as a temporary workaround to prevent exploitation until a patch is available. Restrict access to the url.cpp component to minimize the risk of exploitation. Avoid using the url::recvline function in the affected libproxy versions until the issue is resolved.Exploit
Fix
Uncontrolled Recursion
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Suse
Ubuntu
Libproxy