Vulnerability · Published Jul 14, 2021 · Assigned by mitre

CVE-2020-36420

High 7.5

In plain English

A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)1.9%top 20.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Polipo through 1.1.1, when NDEBUG is omitted, allows denial of service via a reachable assertion during parsing of a malformed Range header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.openwall.com/lists/oss-security/2020/11/18/1 x_refsource_MISC
https://bugs.gentoo.org/755896 x_refsource_MISC
https://github.com/jech/polipo/commit/4d42ca1b5849518762d110f34b6ce2e03d6df9ec x_refsource_MISC
[oss-security] 20210718 Re: Polipo: denial-of-service using range mailing-list, x_refsource_MLIST