CVE-2020-15173

Katalog CVE

CVSS 9.8 · Critical EPSS 1,2%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada accel-ppp. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), there is a buffer overflow when receiving an l2tp control packet ith an AVP which type is a string and no hidden flags, length set to less than 6. If your application is used in open networks or there are untrusted nodes in the network it is highly recommended to apply the patch. The problem was patched with commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b As a workaround changes of commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b can be applied to older versions.

Rincian

Terbit di NVD

9 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/accel-ppp/accel-ppp/commit/2324bcd5ba12cf28f47357a8f03cd41b7c04c52b patch · advisory pihak ketiga
• https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-rr68-fchr-69vf advisory pihak ketiga