Vulnerability Description
In OSSEC-HIDS 2.7 through 3.5.0, the OS_CleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newlines from processed log messages. In many cases, those characters are later logged. Because newlines (\n) are permitted in messages processed by ossec-analysisd, it may be possible to inject nested events into the ossec log. Use of terminal control characters may allow obfuscating events or executing commands when viewed through vulnerable terminal emulators. This may be an unauthenticated remote attack for certain types and origins of logged data.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ossec | Ossec | >= 2.7, <= 3.5.0 |
Related Weaknesses (CWE)
References
- https://github.com/ossec/ossec-hids/issues/1814Third Party Advisory
- https://github.com/ossec/ossec-hids/issues/1821Third Party Advisory
- https://security.gentoo.org/glsa/202007-33Third Party Advisory
- https://www.ossec.net/Vendor Advisory
- https://github.com/ossec/ossec-hids/issues/1814Third Party Advisory
- https://github.com/ossec/ossec-hids/issues/1821Third Party Advisory
- https://security.gentoo.org/glsa/202007-33Third Party Advisory
- https://www.ossec.net/Vendor Advisory
FAQ
What is CVE-2020-8445?
CVE-2020-8445 is a vulnerability with a CVSS score of 9.8 (CRITICAL). In OSSEC-HIDS 2.7 through 3.5.0, the OS_CleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newlines from processed log messages. In many cases, those characte...
How severe is CVE-2020-8445?
CVE-2020-8445 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-8445?
Check the references section above for vendor advisories and patch information. Affected products include: Ossec Ossec.