CVE-2020-17487: High severity Radare Radare2 vulnerability
radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in rx509parsealgorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in IMAGEDIRECTORYENTRYSECURITY.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/radare2to a version that resolves this vulnerability.Fixed in 4.5.1-r0
Event History
Frequently Asked Questions
What is CVE-2020-17487?
CVE-2020-17487 is a vulnerability in radare2 4.5.0 that misparses signature information in PE files causing a segmentation fault.
How severe is CVE-2020-17487?
CVE-2020-17487 has a severity value of 7.5, classified as high.
What causes CVE-2020-17487 in radare2 4.5.0?
CVE-2020-17487 in radare2 4.5.0 is caused by a malformed object identifier in IMAGE_DIRECTORY_ENTRY_SECURITY.
How can CVE-2020-17487 be exploited?
CVE-2020-17487 can be exploited by misparsing signature information in PE files, leading to a segmentation fault.
Is there a fix available for CVE-2020-17487?
At the moment, there are patches and updates available to address CVE-2020-17487 in radare2 4.5.0.