Vulnerability · Published Aug 22, 2023 · Assigned by mitre
CVE-2020-18770
Medium 5.5
In plain English
A medium-severity uncontrolled resource consumption in the zziplib package (AlmaLinux). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.3%top 71.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
An issue was discovered in function zzip_disk_entry_to_file_header in mmapped.c in zziplib 0.13.69, which will lead to a denial-of-service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | zziplib | 0.13.68-13.el8_10 | ALSA-2024:3127 |
| AlmaLinux:9 | zziplib | 0.13.71-11.el9_4 | ALSA-2024:2377 |
| AlmaLinux:8 | zziplib-devel | 0.13.68-13.el8_10 | ALSA-2024:3127 |
| AlmaLinux:9 | zziplib-devel | 0.13.71-11.el9_4 | ALSA-2024:2377 |
| AlmaLinux:8 | zziplib-utils | 0.13.68-13.el8_10 | ALSA-2024:3127 |
| AlmaLinux:9 | zziplib-utils | 0.13.71-11.el9_4 | ALSA-2024:2377 |
| Debian:12 | zziplib | no fix listed | DEBIAN-CVE-2020-18770 |
| Debian:13 | zziplib | 0.13.78+dfsg.1-0.1 | DEBIAN-CVE-2020-18770 |
| Debian:14 | zziplib | 0.13.78+dfsg.1-0.1 | DEBIAN-CVE-2020-18770 |
| Rocky Linux:8 | zziplib | 0:0.13.68-13.el8_10 | RLSA-2024:3127 |
| Rocky Linux:9 | zziplib | 0:0.13.71-11.el9_4 | RLSA-2024:2377 |
| Ubuntu:22.04:LTS | zziplib | no fix listed | UBUNTU-CVE-2020-18770 |
| Ubuntu:24.04:LTS | zziplib | no fix listed | UBUNTU-CVE-2020-18770 |
| Ubuntu:25.10 | zziplib | no fix listed | UBUNTU-CVE-2020-18770 |
| Ubuntu:26.04:LTS | zziplib | no fix listed | UBUNTU-CVE-2020-18770 |
| Ubuntu:26.10 | zziplib | no fix listed | UBUNTU-CVE-2020-18770 |
Affected products (as reported)
Weakness: CWE-400