CVE-2020-22916

An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of "endless output" and "denial of service" because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a reasonable size increase.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://web.archive.org/web/20230918084612/https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2234987
https://bugzilla.suse.com/show_bug.cgi?id=1214590
https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability	Broken Link
https://github.com/tukaani-project/xz/issues/61
https://security-tracker.debian.org/tracker/CVE-2020-22916
https://tukaani.org/xz/	Product
http://web.archive.org/web/20230918084612/https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2234987
https://bugzilla.suse.com/show_bug.cgi?id=1214590
https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability	Broken Link
https://github.com/tukaani-project/xz/issues/61
https://security-tracker.debian.org/tracker/CVE-2020-22916
https://tukaani.org/xz/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:tukaani:xz:5.2.5:*:*:*:*:*:*:*

History

21 Nov 2024, 05:13

Type	Values Removed	Values Added
References	~~() http://web.archive.org/web/20230918084612/https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability -~~	() http://web.archive.org/web/20230918084612/https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability -
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2234987 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2234987 -
References	~~() https://bugzilla.suse.com/show_bug.cgi?id=1214590 -~~	() https://bugzilla.suse.com/show_bug.cgi?id=1214590 -
References	~~() https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability - Broken Link~~	() https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability - Broken Link
References	~~() https://github.com/tukaani-project/xz/issues/61 -~~	() https://github.com/tukaani-project/xz/issues/61 -
References	~~() https://security-tracker.debian.org/tracker/CVE-2020-22916 -~~	() https://security-tracker.debian.org/tracker/CVE-2020-22916 -
References	~~() https://tukaani.org/xz/ - Product~~	() https://tukaani.org/xz/ - Product

07 Nov 2023, 03:19

Type	Values Removed	Values Added
Summary	DISPUTED An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of "endless output" and "denial of service" because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a reasonable size increase.	An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of "endless output" and "denial of service" because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a reasonable size increase.

18 Sep 2023, 09:15

Type	Values Removed	Values Added
References		(MISC) http://web.archive.org/web/20230918084612/https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability -
Summary	An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the software maintainers are unable to reproduce this as of 2023-09-12 because the example crafted file is temporarily offline.	DISPUTED An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of "endless output" and "denial of service" because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a reasonable size increase.

12 Sep 2023, 16:15

Type	Values Removed	Values Added
Summary	~~An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of crafted file.~~	An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the software maintainers are unable to reproduce this as of 2023-09-12 because the example crafted file is temporarily offline.
References		(MISC) https://security-tracker.debian.org/tracker/CVE-2020-22916 - (MISC) https://github.com/tukaani-project/xz/issues/61 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2234987 - (MISC) https://bugzilla.suse.com/show_bug.cgi?id=1214590 -

25 Aug 2023, 17:53

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
CWE		NVD-CWE-noinfo
First Time		Tukaani Tukaani xz
CPE		cpe:2.3:a:tukaani:xz:5.2.5:::::::*
References	~~(MISC) https://tukaani.org/xz/ -~~	(MISC) https://tukaani.org/xz/ - Product
References	~~(MISC) https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability -~~	(MISC) https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability - Broken Link

22 Aug 2023, 20:10

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-08-22 19:16

Updated : 2024-11-21 05:13

NVD link : CVE-2020-22916

Mitre link : CVE-2020-22916

CVE.ORG link : CVE-2020-22916

JSON object : View

Products Affected

tukaani

CWE

NVD-CWE-noinfo

5.5 /10