CVE-2020-6095: Null Pointer Dereference

Published Mar 27, 2020

Updated

An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cause a null pointer deference resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.

Affected Software

3 affected components

Gstreamer Project Gst-rtsp-server=1.14.5

openSUSE Backports SLE=15.0-sp1

openSUSE Leap=15.1

Remediation

Patch Available

https://gitlab.freedesktop.org/gstreamer/gst-rtsp-server/-/commit/44ccca3086dd81081d72ca0b21d0ecdde962fb1a

Event History

Mar 27, 2020

CVE Published

via MITRE·07:20 PM

Data Sourced

via MITRE·07:20 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2020-6095?

CVE-2020-6095 is an exploitable denial of service vulnerability in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5.

What is the severity of CVE-2020-6095?

The severity of CVE-2020-6095 is high, with a severity value of 7.5.

How does CVE-2020-6095 work?

An attacker can send a specially crafted RTSP setup request, causing a null pointer deference that results in denial-of-service.

Which software versions are affected by CVE-2020-6095?

Gstreamer/gst-rtsp-server 1.14.5, openSUSE Backports SLE 15.0-sp1, and openSUSE Leap 15.1 are affected by CVE-2020-6095.

How can I fix CVE-2020-6095?

Upgrade to a patched version of GStreamer/gst-rtsp-server, apply the necessary security patches, or follow the recommendations provided by the software vendor.