Vulnerability Description
A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nbdkit Project | Nbdkit | < 1.12.7 |
| Redhat | Virtualization | 4.0 |
| Redhat | Enterprise Linux | 8.0 |
| Redhat | Enterprise Linux Server | 7.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1757258Issue TrackingPatchThird Party Advisory
- https://www.redhat.com/archives/libguestfs/2019-September/msg00084.htmlExploitMailing ListThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1757258Issue TrackingPatchThird Party Advisory
- https://www.redhat.com/archives/libguestfs/2019-September/msg00084.htmlExploitMailing ListThird Party Advisory
FAQ
What is CVE-2019-14850?
CVE-2019-14850 is a vulnerability with a CVSS score of 3.7 (LOW). A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing bac...
How severe is CVE-2019-14850?
CVE-2019-14850 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-14850?
Check the references section above for vendor advisories and patch information. Affected products include: Nbdkit Project Nbdkit, Redhat Virtualization, Redhat Enterprise Linux, Redhat Enterprise Linux Server.