Lucene search

K
mageiaGentoo FoundationMGASA-2016-0053
HistoryFeb 05, 2016 - 8:26 p.m.

Updated socat packages fix security vulnerability

2016-02-0520:26:09
Gentoo Foundation
advisories.mageia.org
4

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.003 Low

EPSS

Percentile

66.3%

In socat before 2.0.0-b9, in the OpenSSL address implementation, the hard coded 1024 bit DH p parameter was not prime. It may be possible for an eavesdropper to recover the shared secret from a key exchange (CVE-2016-2217). In socat before 2.0.0-b9, a stack overflow vulnerability was found that can be triggered when command line arguments are longer than 512 bytes. This vulnerability can only be exploited when an attacker is able to inject data into socat’s command line.

OSVersionArchitecturePackageVersionFilename
Mageia5noarchsocat< 2.0.0-0.b9.1socat-2.0.0-0.b9.1.mga5

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.003 Low

EPSS

Percentile

66.3%