CVE-2019-20800: Critical severity cherokee web server vulnerability
Published May 17, 2020
·Updated
In Cherokee through 1.2.104, remote attackers can trigger an out-of-bounds write in cherokeehandlercgiaddenvpair in handlercgi.c by sending many request headers, as demonstrated by a GET request with many "Host: 127.0.0.1" headers.
Affected Software
1 affected component
Cherokee-project Cherokee<=1.2.104
Event History
May 17, 2020
CVE Published
via MITRE·11:05 PM
Data Sourced
via MITRE·11:05 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-20800?
CVE-2019-20800 is considered a high severity vulnerability due to its potential for remote exploitation.
2
How do I fix CVE-2019-20800?
To fix CVE-2019-20800, upgrade Cherokee to version 1.2.105 or later, which contains the necessary patches.
3
What type of vulnerability is CVE-2019-20800?
CVE-2019-20800 is an out-of-bounds write vulnerability that can be exploited by sending numerous request headers.
4
Which versions of Cherokee are affected by CVE-2019-20800?
Cherokee versions up to and including 1.2.104 are affected by CVE-2019-20800.
5
Who can exploit CVE-2019-20800?
Remote attackers can exploit CVE-2019-20800 by sending specially crafted requests with multiple headers.