CVE-2020-8445: Input Validation
First published: Thu Jan 30 2020(Updated: )
In OSSEC-HIDS 2.7 through 3.5.0, the OS_CleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newlines from processed log messages. In many cases, those characters are later logged. Because newlines (\n) are permitted in messages processed by ossec-analysisd, it may be possible to inject nested events into the ossec log. Use of terminal control characters may allow obfuscating events or executing commands when viewed through vulnerable terminal emulators. This may be an unauthenticated remote attack for certain types and origins of logged data.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OSSEC | >=2.7<=3.5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-8445?
CVE-2020-8445 has a medium severity rating due to its potential to log unencoded terminal control characters and newlines.
How do I fix CVE-2020-8445?
To fix CVE-2020-8445, upgrade to a version of OSSEC-HIDS later than 3.5.0 which addresses the log message processing vulnerability.
What are the potential impacts of CVE-2020-8445?
The impacts of CVE-2020-8445 include the risk of malformed log entries that can disrupt log analysis and may obscure malicious activity.
Which versions of OSSEC are affected by CVE-2020-8445?
CVE-2020-8445 affects OSSEC-HIDS versions from 2.7 to 3.5.0.
Is CVE-2020-8445 exploitable in a default installation?
Yes, CVE-2020-8445 can be exploited in a default installation if log messages contain unencoded terminal control characters.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ossec
- canonical/ossec
- version/ossec/2.7
- version/ossec/3.5.0