Skip to content
OpenAdvisories
Medium · 5.3 CVE-2020-8859 EUVD-2020-29701GHSA-gxx3-g5rx-565f

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ELOG Electronic Logbook 3.1…

Published Mar 23, 2020 · Updated Aug 4, 2024 · Assigned by zdi

Description

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ELOG Electronic Logbook 3.1.4-283534d. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HTTP parameters. A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition. Was ZDI-CAN-10115.

Affected products

VendorProductAffectedFixed
ELOG Electronic Logbook 3.1.4-283534d —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 9 elog 3.1.2-1-1+deb9u1 DLA-3014-1
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS elog No fix yet —
Ubuntu 20.04 LTS elog No fix yet —
Ubuntu 18.04 LTS elog No fix yet —
Ubuntu 16.04 LTS elog No fix yet —

Advisories 1

References