CVE-2020-7044: In Wireshark 3.2.x before 3.2.1, the WASSP dissector could crash

High severity · published Jan 16, 2020

CVE-2020-7044

In Wireshark 3.2.x before 3.2.1, the WASSP dissector could crash

7.5

CVSS

3.2%

EPSS

On KEV

Description

In Wireshark 3.2.x before 3.2.1, the WASSP dissector could crash. This was addressed in epan/dissectors/packet-wassp.c by using >= and <= to resolve off-by-one errors.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)3.2% · higher than 88% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Fedora · Fedoraproject

30; 31; 32 · source: NVD

Leap · Opensuse

15.1 · source: NVD

Solaris · Oracle

11 · source: NVD

Wireshark · Wireshark

3.2.0 before 3.2.1 · source: NVD

Zfs Storage Appliance Kit · Oracle

8.8 · source: NVD

Affected product

Fedora

Fedoraproject

All Fedora CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-7044

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-7044

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html

Exploit

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16324

code.wireshark.org

https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=f90a3720b73ca140403315126e2a478c4f70ca03

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZBICEY2HGSNQ3RPBLMDDYVAHGOGS4E2/

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDVMBCADP73TBISYCS6ARKOSNNJOGXXZ/

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XN2GMGLT5XND7U34WX3O23WKUZ7JHMVN/