CVE-2019-17502: Null Pointer Dereference
Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. read.c, request.c, and util.c contribute to this. The processheaderend() function calls boaatoi(), which ultimately calls atoi() on a NULL pointer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-17502?
CVE-2019-17502 is classified as a critical vulnerability due to its potential to cause a denial of service through a NULL pointer dereference.
How do I fix CVE-2019-17502?
To mitigate CVE-2019-17502, you should upgrade your version of Hydra to at least 0.1.9 or later.
What systems are affected by CVE-2019-17502?
CVE-2019-17502 affects Hydra versions up to and including 0.1.8.
What types of requests trigger CVE-2019-17502?
CVE-2019-17502 is triggered when processing POST requests that do not include a Content-Length header.
What is the impact of CVE-2019-17502?
The impact of CVE-2019-17502 is that it can lead to daemon crashes, disrupting service availability.