An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade p11-kit-serverUpgrade p11-kit-trustUpgrade p11-kitUpgrade p11-kit-devel | May 4, 2022 | Dec 16, 2020 |
| Alpine Linux | — | Upgrade p11-kit | Mar 26, 2024 | Dec 16, 2020 |
| Amazon Linux Ami 2 | — | Upgrade p11-kitUpgrade p11-kit-develUpgrade p11-kit-trustUpgrade p11-kit-serverUpgrade p11-kit-debuginfo | Feb 22, 2021 | Dec 16, 2020 |
| Centos_linux | — | Upgrade p11-kitUpgrade p11-kit-trust-debuginfoUpgrade p11-kit-serverUpgrade p11-kit-trustUpgrade p11-kit-debugsourceUpgrade p11-kit-develUpgrade p11-kit-debuginfoUpgrade p11-kit-server-debuginfo | Jun 1, 2021 | Dec 16, 2020 |
| Debian | — | Upgrade p11-kit | Jan 4, 2021 | Dec 16, 2020 |
| Freebsd | — | Upgrade p11-kit | Dec 13, 2020 | Dec 12, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade p11-kit-trustUpgrade p11-kitUpgrade p11-kit-develUpgrade p11-kit-server | Feb 2, 2021 | Dec 16, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade p11-kit-trustUpgrade p11-kit | Jan 5, 2021 | Dec 16, 2020 |
| Oracle Solaris | — | Upgrade library/desktop/p11-kit to version 0.23.22-11.4.36.0.1.101.0 on Solaris 11.4 | Aug 27, 2021 | Dec 16, 2020 |
| Oracle_linux | — | Upgrade p11-kit-develUpgrade p11-kitUpgrade p11-kit-trustUpgrade p11-kit-server | May 26, 2021 | Dec 12, 2020 |
| Redhat_linux | — | Upgrade p11-kit-serverUpgrade p11-kitUpgrade p11-kit-server-debuginfoUpgrade p11-kit-trustUpgrade p11-kit-debugsourceUpgrade p11-kit-debuginfoUpgrade p11-kit-trust-debuginfoUpgrade p11-kit-devel | May 21, 2021 | Dec 16, 2020 |
| Rocky_linux | — | Upgrade p11-kit-serverUpgrade p11-kitUpgrade p11-kit-trust-debuginfoUpgrade p11-kit-debugsourceUpgrade p11-kit-server-debuginfoUpgrade p11-kit-debuginfoUpgrade p11-kit-trustUpgrade p11-kit-devel | Mar 12, 2024 | Dec 16, 2020 |
| Suse | — | Upgrade p11-kit-develUpgrade p11-kit-toolsUpgrade p11-kit-serverUpgrade p11-kit-nss-trustUpgrade libp11-kit0Upgrade p11-kitUpgrade libp11-kit0-32bit | Aug 9, 2024 | Dec 16, 2020 |
| Ubuntu | — | Upgrade p11-kitUpgrade libp11-kit0Upgrade p11-kit-modules | Jan 6, 2021 | Dec 12, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub