CVE-2018-20809: Input Validation
Published Mar 16, 2019
·Updated
A crafted message can cause the web server to crash with Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R5 and Pulse Policy Secure 5.4RX before 5.4R5. This is not applicable to PCS 8.1RX.
Affected Software
101 affected components
PulseSecure Pulse Connect Secure=8.3-r1
PulseSecure Pulse Connect Secure=8.3-r2
PulseSecure Pulse Connect Secure=8.3-r2.1
PulseSecure Pulse Connect Secure=8.3-r3
PulseSecure Pulse Connect Secure=8.3-r4
PulseSecure Pulse Policy Secure=4.4-r1.0
PulseSecure Pulse Policy Secure=4.4-r1.1
PulseSecure Pulse Policy Secure=4.4-r10
PulseSecure Pulse Policy Secure=4.4-r11.1
PulseSecure Pulse Policy Secure=4.4-r12.0
PulseSecure Pulse Policy Secure=4.4-r13.1
PulseSecure Pulse Policy Secure=4.4-r13.2
PulseSecure Pulse Policy Secure=4.4-r13.3
PulseSecure Pulse Policy Secure=4.4-r130
PulseSecure Pulse Policy Secure=4.4-r2.0
PulseSecure Pulse Policy Secure=4.4-r3.0
PulseSecure Pulse Policy Secure=4.4-r4.0
PulseSecure Pulse Policy Secure=4.4-r5.0
PulseSecure Pulse Policy Secure=4.4-r6.0
PulseSecure Pulse Policy Secure=4.4-r7.0
PulseSecure Pulse Policy Secure=4.4-r8.0
PulseSecure Pulse Policy Secure=5.0-r1.0
PulseSecure Pulse Policy Secure=5.0-r10.0
PulseSecure Pulse Policy Secure=5.0-r11.0
PulseSecure Pulse Policy Secure=5.0-r12.1
PulseSecure Pulse Policy Secure=5.0-r13.0
PulseSecure Pulse Policy Secure=5.0-r13.1
PulseSecure Pulse Policy Secure=5.0-r2.0
PulseSecure Pulse Policy Secure=5.0-r3.0
PulseSecure Pulse Policy Secure=5.0-r3.2
PulseSecure Pulse Policy Secure=5.0-r4.0
PulseSecure Pulse Policy Secure=5.0-r4.1
PulseSecure Pulse Policy Secure=5.0-r5.0
PulseSecure Pulse Policy Secure=5.0-r6.0
PulseSecure Pulse Policy Secure=5.0-r7.0
PulseSecure Pulse Policy Secure=5.0-r7.1
PulseSecure Pulse Policy Secure=5.0-r8.0
PulseSecure Pulse Policy Secure=5.0-r8.1
PulseSecure Pulse Policy Secure=5.0-r9.0
PulseSecure Pulse Policy Secure=5.1-r1.0
PulseSecure Pulse Policy Secure=5.1-r1.1
PulseSecure Pulse Policy Secure=5.1-r10.0
PulseSecure Pulse Policy Secure=5.1-r11.0
PulseSecure Pulse Policy Secure=5.1-r12.0
PulseSecure Pulse Policy Secure=5.1-r12.1
PulseSecure Pulse Policy Secure=5.1-r13.0
PulseSecure Pulse Policy Secure=5.1-r14.0
PulseSecure Pulse Policy Secure=5.1-r2.0
PulseSecure Pulse Policy Secure=5.1-r2.1
PulseSecure Pulse Policy Secure=5.1-r3.0
PulseSecure Pulse Policy Secure=5.1-r3.2
PulseSecure Pulse Policy Secure=5.1-r4.0
PulseSecure Pulse Policy Secure=5.1-r5.0
PulseSecure Pulse Policy Secure=5.1-r6.0
PulseSecure Pulse Policy Secure=5.1-r7.0
PulseSecure Pulse Policy Secure=5.1-r8.0
PulseSecure Pulse Policy Secure=5.1-r9.0
PulseSecure Pulse Policy Secure=5.1-r9.1
PulseSecure Pulse Policy Secure=5.2-r1.0
PulseSecure Pulse Policy Secure=5.2-r10.0
PulseSecure Pulse Policy Secure=5.2-r11.0
PulseSecure Pulse Policy Secure=5.2-r2.0
PulseSecure Pulse Policy Secure=5.2-r3.0
PulseSecure Pulse Policy Secure=5.2-r3.2
PulseSecure Pulse Policy Secure=5.2-r4.0
PulseSecure Pulse Policy Secure=5.2-r5.0
PulseSecure Pulse Policy Secure=5.2-r6.0
PulseSecure Pulse Policy Secure=5.2-r7.0
PulseSecure Pulse Policy Secure=5.2-r7.1
PulseSecure Pulse Policy Secure=5.2-r8.0
PulseSecure Pulse Policy Secure=5.2-r9.0
PulseSecure Pulse Policy Secure=5.2-r9.1
PulseSecure Pulse Policy Secure=5.3-r1.0
PulseSecure Pulse Policy Secure=5.3-r1.1
PulseSecure Pulse Policy Secure=5.3-r10.0
PulseSecure Pulse Policy Secure=5.3-r11.0
PulseSecure Pulse Policy Secure=5.3-r12.0
PulseSecure Pulse Policy Secure=5.3-r2.0
PulseSecure Pulse Policy Secure=5.3-r3.0
PulseSecure Pulse Policy Secure=5.3-r3.1
PulseSecure Pulse Policy Secure=5.3-r4.0
PulseSecure Pulse Policy Secure=5.3-r4.1
PulseSecure Pulse Policy Secure=5.3-r5.0
PulseSecure Pulse Policy Secure=5.3-r5.1
PulseSecure Pulse Policy Secure=5.3-r5.2
PulseSecure Pulse Policy Secure=5.3-r6.0
PulseSecure Pulse Policy Secure=5.3-r7.0
PulseSecure Pulse Policy Secure=5.3-r8.0
PulseSecure Pulse Policy Secure=5.3-r8.1
PulseSecure Pulse Policy Secure=5.3-r8.2
PulseSecure Pulse Policy Secure=5.3-r9.0
PulseSecure Pulse Policy Secure=5.4-r1
PulseSecure Pulse Policy Secure=5.4-r2
PulseSecure Pulse Policy Secure=5.4-r2.1
PulseSecure Pulse Policy Secure=5.4-r3
PulseSecure Pulse Policy Secure=5.4-r4
Ivanti Connect Secure=8.3-r1
Ivanti Connect Secure=8.3-r2
Ivanti Connect Secure=8.3-r2.1
Ivanti Connect Secure=8.3-r3
Ivanti Connect Secure=8.3-r4
Event History
Mar 16, 2019
CVE Published
via MITRE·03:00 AM
Data Sourced
via MITRE·03:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-20809?
CVE-2018-20809 is considered a critical vulnerability as it can cause the web server to crash.
2
How do I fix CVE-2018-20809?
To fix CVE-2018-20809, upgrade to Pulse Secure Pulse Connect Secure version 8.3R5 or later, or Pulse Policy Secure version 5.4R5 or later.
3
What versions are affected by CVE-2018-20809?
CVE-2018-20809 affects Pulse Secure Pulse Connect Secure versions 8.3RX before 8.3R5 and Pulse Policy Secure versions 5.4RX before 5.4R5.
4
Are earlier versions of Pulse Secure vulnerable to CVE-2018-20809?
Yes, earlier versions of Pulse Secure Pulse Connect Secure and Pulse Policy Secure prior to the mentioned updates are vulnerable to CVE-2018-20809.
5
Is CVE-2018-20809 applicable to all Pulse Secure products?
No, CVE-2018-20809 is not applicable to Pulse Secure Connect Secure version 8.1RX.