CVE-2020-22916
First published: Tue Aug 22 2023(Updated: )
** DISPUTED ** An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of "endless output" and "denial of service" because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a reasonable size increase.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tukaani XZ | =5.2.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://tukaani.org/xz/
- https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2235294
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2235295
- https://bugzilla.redhat.com/show_bug.cgi?id=2234987
- http://web.archive.org/web/20230918084612/https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability
- https://bugzilla.suse.com/show_bug.cgi?id=1214590
- https://github.com/tukaani-project/xz/issues/61
- https://security-tracker.debian.org/tracker/CVE-2020-22916
Frequently Asked Questions
What is CVE-2020-22916?
CVE-2020-22916 is a vulnerability discovered in XZ version 5.2.5 that allows attackers to cause a denial of service by exploiting a crafted file during decompression.
What is the severity of CVE-2020-22916?
The severity of CVE-2020-22916 is medium with a severity value of 5.5.
How can I fix CVE-2020-22916?
To fix CVE-2020-22916, update to a version of XZ that is not affected by this vulnerability, if available. Ensure you are using the latest version and follow any provided patches or updates from the vendor.
Is there any dispute regarding CVE-2020-22916?
Yes, there is a dispute regarding CVE-2020-22916 as the vendor disputes the claims of "endless output" and "denial of service" associated with the vulnerability.
Where can I find more information about CVE-2020-22916?
You can find more information about CVE-2020-22916 on the Debian Security Tracker page, the official Tukaani XZ website, and the GitHub repository that reported the vulnerability.
- collector/redhat-bugzilla
- alias/CVE-2020-22916
- agent/author
- agent/type
- collector/security-tracker-debian
- source/Debian
- agent/severity
- agent/references
- agent/status
- agent/description
- agent/softwarecombine
- agent/tags
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- status/disputed
- vendor/tukaani
- canonical/tukaani xz
- version/tukaani xz/5.2.5