CVE-2019-3994: Use After Free

Q: What is CVE-2019-3994?

CVE-2019-3994 is a denial of service vulnerability in ELOG 3.1.4-57bea22 and below, which allows a remote unauthenticated attacker to crash the ELOG server.

Q: How does CVE-2019-3994 affect ELOG?

CVE-2019-3994 affects ELOG 3.1.4-57bea22 and below by causing a denial of service through a use after free vulnerability.

Q: How severe is CVE-2019-3994?

CVE-2019-3994 has a severity rating of 7.5 (high).

Q: What is the CWE number for CVE-2019-3994?

The CWE number for CVE-2019-3994 is 416.

Q: How can I mitigate CVE-2019-3994?

To mitigate CVE-2019-3994, it is recommended to update ELOG to a version that is not affected by the vulnerability.

Published Dec 17, 2019

Updated

ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a use after free. A remote unauthenticated attacker can crash the ELOG server by sending multiple HTTP POST requests which causes the ELOG function retrieveurl() to use a freed variable.

Affected Software

3 affected components

Elog Project Elog<=3.1.4-57bea22

Fedoraproject Fedora=30

Fedoraproject Fedora=31

Event History

Dec 17, 2019

CVE Published

via MITRE·09:59 PM

Data Sourced

via MITRE·09:59 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2019-3994?

CVE-2019-3994 is a denial of service vulnerability in ELOG 3.1.4-57bea22 and below, which allows a remote unauthenticated attacker to crash the ELOG server.

How does CVE-2019-3994 affect ELOG?

CVE-2019-3994 affects ELOG 3.1.4-57bea22 and below by causing a denial of service through a use after free vulnerability.

How severe is CVE-2019-3994?