CVE-2020-19860: Medium severity nlnet labs ldns vulnerability

Published Jan 21, 2022

Updated

When ldns version 1.7.1 verifies a zone file, the ldnsrrnewfrmstrinternal function has a heap out of bounds read vulnerability. An attacker can leak information on the heap by constructing a zone file payload.

Affected Software

1 affected component

nlnetlabs Ldns=1.7.1

Remediation

Patch Available

https://github.com/NLnetLabs/ldns/commit/15d96206996bea969fbc918eb0a4a346f514b9f3

Event History

Jan 21, 2022

CVE Published

via MITRE·01:40 PM

Data Sourced

via MITRE·01:40 PM

Description

Frequently Asked Questions

What is CVE-2020-19860?

CVE-2020-19860 is a vulnerability in ldns version 1.7.1 that allows an attacker to leak information on the heap by constructing a malicious zone file payload.

How severe is CVE-2020-19860?

CVE-2020-19860 has a severity value of 6.5 which is considered medium.

How does CVE-2020-19860 affect the ldns software?

CVE-2020-19860 affects ldns version 1.7.1 and can be exploited when verifying a zone file using the ldns_rr_new_frm_str_internal function.

Is there a fix available for CVE-2020-19860?

Yes, a fix for CVE-2020-19860 has been provided in the ldns version 1.7.2 release.

Where can I find more information about CVE-2020-19860?

You can find more information about CVE-2020-19860 in the following references: [GitHub commit](https://github.com/NLnetLabs/ldns/commit/15d96206996bea969fbc918eb0a4a346f514b9f3) and [GitHub issue](https://github.com/NLnetLabs/ldns/issues/50).