CVE-2019-14851: Medium severity nbdkit vulnerability
A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertion failure, causing nbdkit to exit. This issue only affected nbdkit versions 1.12.7, 1.14.1, and 1.15.1.
Other sources
The fix for the premature open flaw in nbdkit introduced a new vulnerability, in that a client issuing NBDOPTINFO before NBDOPTGO would trigger back-to-back calls to the open() callback, leading to an assertion failure because the first open() did not have a matching close(). No known nbdkit clients behaved in this way, but a crafted client could use this to cause nbdkit to exit.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-14851?
CVE-2019-14851 is a denial of service vulnerability discovered in nbdkit.
Which versions of nbdkit are affected by CVE-2019-14851?
Nbdkit versions 1.12.7, 1.14.1, and 1.15.1 are affected by CVE-2019-14851.
How can CVE-2019-14851 be exploited?
A client issuing a certain sequence of commands can exploit CVE-2019-14851 to trigger an assertion failure in nbdkit, causing it to exit.
What is the severity of CVE-2019-14851?
The severity of CVE-2019-14851 is medium with a CVSS score of 6.5.
How can CVE-2019-14851 be fixed?
To fix CVE-2019-14851, update nbdkit to version 1.12.8, 1.14.2, or 1.15.2.