CVE-2020-26418

Published: Dec 11, 2020Modified: Nov 21, 2024

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Memory leak in Kafka protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file.

Affected (6)

Products: Wireshark: Wireshark · Fedoraproject: Fedora · Debian: Debian Linux · +1 more

Show all products

Wireshark: Wireshark · Fedoraproject: Fedora · Debian: Debian Linux · Oracle: Zfs Storage Appliance Kit

1 product

1 product

1 product

1 product

Zfs Storage Appliance Kit

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Wireshark Wireshark	From 3.2.0 to 3.2.8
Wireshark Wireshark	Version 3.4.0

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Zfs Storage Appliance Kit	Version 8.8

Related CWEs

CWE-401

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (16)

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26418.json

Source: cve@gitlab.com

Third Party Advisory

https://gitlab.com/wireshark/wireshark/-/issues/16739

Source: cve@gitlab.com

ExploitIssue TrackingThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html

Source: cve@gitlab.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M75HYXU36SP6GHIDPHNZGJKEO6TX4C4Y/

Source: cve@gitlab.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YHWDZPWQJMLK64VFDWJC5SEGPNH6Y72Z/

Source: cve@gitlab.com

https://security.gentoo.org/glsa/202101-12

Source: cve@gitlab.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: cve@gitlab.com

PatchThird Party Advisory

https://www.wireshark.org/security/wnpa-sec-2020-16.html

Source: cve@gitlab.com

Vendor Advisory

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26418.json