CVE-2020-12845: Null Pointer Dereference
Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. A remote unauthenticated attacker can crash the server by sending an HTTP request to protected resources using a malformed Authorization header that is mishandled during a cherokeebufferadd call within cherokeevalidatorparsebasic or cherokeevalidatorparsedigest.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-12845?
CVE-2020-12845 has been classified as a high severity vulnerability due to its potential for denial of service.
How do I fix CVE-2020-12845?
To mitigate CVE-2020-12845, upgrade Cherokee to version 1.2.105 or later where the vulnerability has been addressed.
What impact does CVE-2020-12845 have on Cherokee users?
CVE-2020-12845 allows remote attackers to crash the Cherokee server by sending specially crafted HTTP requests.
Which versions of Cherokee are affected by CVE-2020-12845?
CVE-2020-12845 affects Cherokee versions from 0.4.27 to 1.2.104 inclusively.
Is CVE-2020-12845 an authenticated or unauthenticated vulnerability?
CVE-2020-12845 is an unauthenticated vulnerability, allowing remote attackers to exploit it without authentication.