Vulnerability Description
The (1) i2pd before 2.17 and (2) kovri pre-alpha implementations of the I2P routing protocol do not properly handle Garlic DeliveryTypeTunnel packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading sensitive router memory, aka the GarlicRust bug.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Getkovri | Kovri | - |
| I2Pd | I2Pd | <= 2.16.0 |
Related Weaknesses (CWE)
References
- https://eyalitkin.wordpress.com/2017/12/04/cve-publication-garlicrust-cve-2017-1Issue TrackingThird Party Advisory
- https://hackerone.com/reports/291489Issue TrackingThird Party Advisory
- https://eyalitkin.wordpress.com/2017/12/04/cve-publication-garlicrust-cve-2017-1Issue TrackingThird Party Advisory
- https://hackerone.com/reports/291489Issue TrackingThird Party Advisory
FAQ
What is CVE-2017-17066?
CVE-2017-17066 is a vulnerability with a CVSS score of 7.5 (HIGH). The (1) i2pd before 2.17 and (2) kovri pre-alpha implementations of the I2P routing protocol do not properly handle Garlic DeliveryTypeTunnel packets, which allows remote attackers to obtain sensitive...
How severe is CVE-2017-17066?
CVE-2017-17066 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-17066?
Check the references section above for vendor advisories and patch information. Affected products include: Getkovri Kovri, I2Pd I2Pd.