CVE-2019-14851

{"containers": {"cna": {"affected": [{"product": "nbdkit", "vendor": "n/a", "versions": [{"status": "affected", "version": "nbdkit 1.12.8, nbdkit 1.14.2, nbdkit 1.15.2"}]}], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertion failure, causing nbdkit to exit. This issue only affected nbdkit versions 1.12.7, 1.14.1, and 1.15.1."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-617", "description": "CWE-617", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-03-18T19:04:21.000Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757259"}, {"tags": ["x_refsource_MISC"], "url": "https://www.redhat.com/archives/libguestfs/2019-September/msg00272.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2019-14851", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "nbdkit", "version": {"version_data": [{"version_value": "nbdkit 1.12.8, nbdkit 1.14.2, nbdkit 1.15.2"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertion failure, causing nbdkit to exit. This issue only affected nbdkit versions 1.12.7, 1.14.1, and 1.15.1."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-617"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1757259", "refsource": "MISC", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757259"}, {"name": "https://www.redhat.com/archives/libguestfs/2019-September/msg00272.html", "refsource": "MISC", "url": "https://www.redhat.com/archives/libguestfs/2019-September/msg00272.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T00:26:39.132Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757259"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.redhat.com/archives/libguestfs/2019-September/msg00272.html"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2019-14851", "datePublished": "2021-03-18T19:04:21.000Z", "dateReserved": "2019-08-10T00:00:00.000Z", "dateUpdated": "2024-08-05T00:26:39.132Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "nbdkit", "vendor": "n/a", "versions": [{"status": "affected", "version": "nbdkit 1.12.8, nbdkit 1.14.2, nbdkit 1.15.2"}]}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nbdkit_project:nbdkit:*:*:*:*:*:*:*:*", "matchCriteriaId": "A063E03B-A7F8-4485-AC7A-670482AABDB2", "versionEndExcluding": "1.12.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:nbdkit_project:nbdkit:*:*:*:*:*:*:*:*", "matchCriteriaId": "9E34640C-18B4-4C3F-BA2E-EB55137D0F6A", "versionEndExcluding": "1.14.1", "versionStartIncluding": "1.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nbdkit_project:nbdkit:*:*:*:*:*:*:*:*", "matchCriteriaId": "45F3323B-D58A-4029-B8E4-A265571EE38C", "versionEndExcluding": "1.15.1", "versionStartIncluding": "1.15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertion failure, causing nbdkit to exit. This issue only affected nbdkit versions 1.12.7, 1.14.1, and 1.15.1."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad de denegaci\u00f3n de servicio en nbdkit. Un cliente que emita una determinada secuencia de comandos podr\u00eda desencadenar un fallo de aserci\u00f3n, causando la salida de nbdkit. Este problema solo afect\u00f3 a versiones 1.12.7, 1.14.1 y 1.15.1 de nbdkit"}], "id": "CVE-2019-14851", "lastModified": "2026-06-17T02:19:10.080", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-03-18T20:15:12.550", "references": [{"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757259"}, {"source": "secalert@redhat.com", "tags": ["Mailing List", "Patch", "Vendor Advisory"], "url": "https://www.redhat.com/archives/libguestfs/2019-September/msg00272.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757259"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Vendor Advisory"], "url": "https://www.redhat.com/archives/libguestfs/2019-September/msg00272.html"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "This issue was discovered by Eric Blake (Red Hat).", "bugzilla": {"description": "nbdkit: assertion failure by issuing commands in the wrong order", "id": "1757259", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757259"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertion failure, causing nbdkit to exit. This issue only affected nbdkit versions 1.12.7, 1.14.1, and 1.15.1.", "A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertion failure, causing nbdkit to exit. This issue only affected nbdkit versions 1.12.7, 1.14.1, and 1.15.1."], "mitigation": {"lang": "en:us", "value": "If nbdkit is configured with TLS client authentication, only trusted clients can carry out this attack.\nOnly attackers that can connect to the nbdkit service can exploit this vulnerability. If nbdkit is not exposed over TCP (eg, nbdkit -U), or is bound only to a private network interface, or is protected by firewall rules, the attack surface is correspondingly limited."}, "name": "CVE-2019-14851", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "nbdkit", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "nbdkit", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:advanced_virtualization:8::el8", "fix_state": "Not affected", "package_name": "nbdkit", "product_name": "Red Hat Enterprise Linux 8 Advanced Virtualization"}, {"cpe": "cpe:/o:redhat:rhev_hypervisor:4", "fix_state": "Not affected", "package_name": "nbdkit", "product_name": "Red Hat Virtualization 4"}], "public_date": "2019-09-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-14851\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-14851\nhttps://www.redhat.com/archives/libguestfs/2019-September/msg00272.html"], "threat_severity": "Moderate"}

{}