CVE-2020-9428: High severity Wireshark Wireshark vulnerability
Published Feb 27, 2020
·Updated
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing.
Affected Software
8 affected components
Wireshark Wireshark>=2.6.0<=2.6.14
Wireshark Wireshark>=3.0.0<=3.0.8
Wireshark Wireshark>=3.2.0<=3.2.1
Debian Debian Linux=9.0
Fedoraproject Fedora=30
Fedoraproject Fedora=31
Fedoraproject Fedora=32
openSUSE Leap=15.1
Remediation
Event History
Feb 27, 2020
CVE Published
via MITRE·10:06 PM
Data Sourced
via MITRE·10:06 PM
Description
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2020-9428?
CVE-2020-9428 is classified as a high severity vulnerability due to the potential for application crashes.
2
How do I fix CVE-2020-9428?
To fix CVE-2020-9428, upgrade Wireshark to version 3.2.2 or later, or version 3.0.9 or later, or version 2.6.15 or later.
3
What versions of Wireshark are affected by CVE-2020-9428?
CVE-2020-9428 affects Wireshark versions 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14.
4
What component of Wireshark does CVE-2020-9428 impact?
CVE-2020-9428 impacts the EAP dissector component of Wireshark.
5
What mitigation exists for CVE-2020-9428?
The primary mitigation for CVE-2020-9428 is to ensure that you are using a patched version of Wireshark.