CVE-2019-14850
Low
Description
A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.
SeverityLow
CVSS3.7
Exploit probability—
Product
Nbdkit
PublishedMar 18, 2021
First seenMar 18, 2021
Weakness typeCWE-406CWE-406
How to fix
Update
- nbdkit_project nbdkit1.12.7, 1.14.1, 1.15.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nbdkit_project nbdkit | v < 1.12.7, 1.14.0 ≤ v < 1.14.1, 1.15.0 ≤ v < 1.15.1 | 1.12.7, 1.14.1, 1.15.1 |
| redhat virtualization | 4.0 | — |
| redhat enterprise_linux | 8.0 | — |
| redhat enterprise_linux_server | 7.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.