Vulnerability · Published Oct 7, 2020 · Assigned by mitre
CVE-2020-26164
Medium 5.5
In plain English
A medium-severity security flaw in the kdeconnect package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.6%top 53.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | kdeconnect | 20.08.2-r0 | ALPINE-CVE-2020-26164 |
| Alpine:v3.21 | kdeconnect | 20.08.2-r0 | ALPINE-CVE-2020-26164 |
| Alpine:v3.22 | kdeconnect | 20.08.2-r0 | ALPINE-CVE-2020-26164 |
| Alpine:v3.23 | kdeconnect | 20.08.2-r0 | ALPINE-CVE-2020-26164 |
| Alpine:v3.24 | kdeconnect | 20.08.2-r0 | ALPINE-CVE-2020-26164 |
| Debian:12 | kdeconnect | 20.08.2-1 | DEBIAN-CVE-2020-26164 |
| Debian:13 | kdeconnect | 20.08.2-1 | DEBIAN-CVE-2020-26164 |
| Debian:14 | kdeconnect | 20.08.2-1 | DEBIAN-CVE-2020-26164 |
| Ubuntu:22.04:LTS | kdeconnect | no fix listed | UBUNTU-CVE-2020-26164 |
| Ubuntu:24.04:LTS | kdeconnect | no fix listed | UBUNTU-CVE-2020-26164 |
| Ubuntu:25.10 | kdeconnect | no fix listed | UBUNTU-CVE-2020-26164 |
| Ubuntu:26.04:LTS | kdeconnect | no fix listed | UBUNTU-CVE-2020-26164 |
| Ubuntu:26.10 | kdeconnect | no fix listed | UBUNTU-CVE-2020-26164 |
Affected products (as reported)
References
- https://kdeconnect.kde.org/official/ x_refsource_MISC
- https://github.com/KDE/kdeconnect-kde/releases x_refsource_MISC
- https://bugzilla.suse.com/show_bug.cgi?id=1176268 x_refsource_MISC
- https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00014.html x_refsource_CONFIRM
- https://github.com/KDE/kdeconnect-kde/commit/ce0f00fc2d3eccb51d0af4eba61a4f60de086a59 x_refsource_MISC
- https://github.com/KDE/kdeconnect-kde/commit/542d94a70c56aa386c8d4d793481ce181b0422e8 x_refsource_MISC
- https://github.com/KDE/kdeconnect-kde/commit/613899be24b6e2a6b3e5cc719efce8ae8a122991 x_refsource_MISC
- https://github.com/KDE/kdeconnect-kde/commit/024e5f23db8d8ad3449714b906b46094baaffb89 x_refsource_MISC
- https://github.com/KDE/kdeconnect-kde/commit/4fbd01a3d44a0bcca888c49a77ec7cfd10e113d7 x_refsource_MISC
- https://github.com/KDE/kdeconnect-kde/commit/8112729eb0f13e6947984416118531078e65580d x_refsource_MISC
- https://kde.org/info/security/advisory-20201002-1.txt x_refsource_CONFIRM
- openSUSE-SU-2020:1647 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1650 vendor-advisory, x_refsource_SUSE
- [oss-security] 20201013 Re: kdeconnect: CVE-2020-26164: multiple security issues in kdeconnectd network daemon mailing-list, x_refsource_MLIST
- [oss-security] 20201013 kdeconnect: CVE-2020-26164: multiple security issues in kdeconnectd network daemon mailing-list, x_refsource_MLIST
- [oss-security] 20201014 Re: kdeconnect: CVE-2020-26164: multiple security issues in kdeconnectd network daemon mailing-list, x_refsource_MLIST
- [oss-security] 20201130 Re: kdeconnect: CVE-2020-26164: multiple security issues in kdeconnectd network daemon mailing-list, x_refsource_MLIST
- GLSA-202101-16 vendor-advisory, x_refsource_GENTOO