CVE-2018-1000121: A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service

High severity · published Mar 14, 2018

CVE-2018-1000121

A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service

7.5

CVSS

9.2%

EPSS

On KEV

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)9.2% · higher than 95% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Communications Webrtc Session Controller · Oracle

before 7.2 · source: NVD

Curl · Haxx

7.21.0 through 7.58.0 · source: NVD

Debian Linux · Debian

7.0; 8.0; 9.0 · source: NVD

Enterprise Linux Desktop · Redhat

7.0 · source: NVD

Enterprise Linux Server · Redhat

7.0 · source: NVD

Enterprise Linux Workstation · Redhat

7.0 · source: NVD

Enterprise Manager Ops Center · Oracle

12.2.2; 12.3.3 · source: NVD

Peoplesoft Enterprise Peopletools · Oracle

8.55; 8.56; 8.57 · source: NVD

Ubuntu Linux · Canonical

12.04; 14.04; 16.04; 17.10 · source: NVD

Affected product

Ubuntu Linux

Canonical

All Ubuntu Linux CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2018-1000121

CVE.org

https://www.cve.org/CVERecord?id=CVE-2018-1000121

Patch

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Patch

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Third Party Advisory

http://www.securityfocus.com/bid/103415

Third Party Advisory

http://www.securitytracker.com/id/1040529

Third Party Advisory

https://access.redhat.com/errata/RHBA-2019:0327

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:3157