CVE-2020-36403: High severity htslib vulnerability
Published Jul 1, 2021
·Updated
HTSlib through 1.10.2 allows out-of-bounds write access in vcfparseformat (called from vcfparse and vcfread).
Affected Software
2 affected components
HTSlib HTSlib<=1.10.2
Linux Linux kernel
Remediation
Patch Available
Event History
Jul 1, 2021
CVE Published
via MITRE·02:51 AM
Data Sourced
via MITRE·02:51 AM
Description
Frequently Asked Questions
1
What attacker interaction is required to exploit this issue?
The CVSS vector indicates that exploitation can be performed over a network with low attack complexity and requires no privileges, but user interaction is required. The vulnerability is reached while HTSlib parses VCF format data through vcf_parse_format, vcf_parse, or vcf_read.
2
What is the potential impact if exploitation succeeds?
Successful exploitation can cause an out-of-bounds write and may compromise confidentiality, integrity, and availability. The CVSS score is 8.8 (High).
3
Which versions should be remediated?
HTSlib versions through 1.10.2 are affected. A patch is available; apply the vendor-provided fix referenced by commit dcd4b7304941a8832fba2d0fc4c1e716e7a4e72c.