Log in Start free

Vulnerability · Published Feb 26, 2021 · Assigned by mitre

CVE-2020-27618

Medium 5.5

In plain English

A medium-severity infinite loop in the glibc-benchtests package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.9%top 38.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8glibc-benchtests2.28-151.el8ALSA-2021:1585
AlmaLinux:8glibc-nss-devel2.28-151.el8ALSA-2021:1585
AlmaLinux:8glibc-static2.28-151.el8ALSA-2021:1585
AlmaLinux:8nss_hesiod2.28-151.el8ALSA-2021:1585
Debian:12glibc2.31-5DEBIAN-CVE-2020-27618
Debian:13glibc2.31-5DEBIAN-CVE-2020-27618
Debian:14glibc2.31-5DEBIAN-CVE-2020-27618
Rocky Linux:8glibc0:2.28-151.el8RLSA-2021:1585

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-835 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References