USN-8980-1: dmitry vulnerabilities
It was discovered that DMitry incorrectly handled long arguments, leading to a stack-based buffer overflow. An attacker could possibly use this issue to cause DMitry to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-7938)
It was discovered that DMitry incorrectly handled long lines in WHOIS responses, leading to a stack-based buffer overflow. A remote attacker could possibly use this issue to cause DMitry to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-14931)
It was discovered that DMitry contained a format string vulnerability. An attacker could possibly use this issue to cause DMitry to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-31837)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/dmitryto a version that resolves this vulnerability.Fixed in 1.3a-1ubuntu0.16.04.1~esm1 - Upgrade
Upgrade
ubuntu/dmitryto a version that resolves this vulnerability.Fixed in 1.3a-1ubuntu0.18.04.1~esm1 - Upgrade
Upgrade
ubuntu/dmitryto a version that resolves this vulnerability.Fixed in 1.3a-1ubuntu0.20.04.1~esm1 - Upgrade
Upgrade
ubuntu/dmitryto a version that resolves this vulnerability.Fixed in 1.3a-1.2ubuntu0.22.04.1~esm1 - Upgrade
Upgrade
ubuntu/dmitryto a version that resolves this vulnerability.Fixed in 1.3a-3ubuntu0.1~esm1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which issue can be triggered by a remote party without supplying command-line arguments?
CVE-2020-14931 can be triggered through an overly long line in a WHOIS response. A remote attacker able to provide or control such a response could cause a crash or potentially execute arbitrary code.
Are all of the reported issues limited to denial of service?
No. Each issue may cause DMitry to crash, but the advisory also states that arbitrary code execution may be possible for the long-argument overflow, the WHOIS-response overflow, and the format string vulnerability.