Log in Start free

Vulnerability · Published Feb 5, 2020 · Assigned by GitHub_M

CVE-2020-5208remote code execution vulnerability in ipmitool

High 7.7

In plain English

A high-severity buffer overflow in ipmitool from ipmitool. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)3.3%top 11.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20ipmitool1.8.18-r9ALPINE-CVE-2020-5208
Alpine:v3.21ipmitool1.8.18-r9ALPINE-CVE-2020-5208
Alpine:v3.22ipmitool1.8.18-r9ALPINE-CVE-2020-5208
Alpine:v3.23ipmitool1.8.18-r9ALPINE-CVE-2020-5208
Alpine:v3.24ipmitool1.8.18-r9ALPINE-CVE-2020-5208
Debian:12ipmitool1.8.18-10.1DEBIAN-CVE-2020-5208
Debian:13ipmitool1.8.18-10.1DEBIAN-CVE-2020-5208
Debian:14ipmitool1.8.18-10.1DEBIAN-CVE-2020-5208
Ubuntu:24.04:LTSipmitoolno fix listedUBUNTU-CVE-2020-5208
Ubuntu:25.10ipmitoolno fix listedUBUNTU-CVE-2020-5208
Ubuntu:26.04:LTSipmitoolno fix listedUBUNTU-CVE-2020-5208
Ubuntu:26.10ipmitoolno fix listedUBUNTU-CVE-2020-5208

Affected products (as reported)

VendorProductVersions
ipmitool ipmitool unspecified – before < 1.8.19

Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

References