Search
Find a vulnerability
Search criteria
16 vulnerabilities found for accel-ppp by accel-ppp
CVE-2026-123205 (GCVE-0-2026-123205)
Vulnerability from nvd – Published: 2026-11-05 18:16 – Updated: 2026-11-09 17:45
VLAI
EPSS
VEX
Title
accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsql
Summary
accel-ppp before 1.15.0 contains a heap buffer overflow vulnerability in the tcp, syslog and pgsql log targets that allows unauthenticated remote peers to overflow fixed heap buffers by producing log lines exceeding LOG_MAX_SIZE. Attackers within client-ip-range can send an L2TP Start-Control-Connection-Request with many string AVPs when verbose logging is enabled to corrupt heap memory and crash the daemon.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:35 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/accel-ppp/accel-ppp/pull/374 | issue-trackingpatch |
| https://github.com/accel-ppp/accel-ppp/commit/58e… | patch |
| https://github.com/accel-ppp/accel-ppp/releases/t… | release-notes |
| https://github.com/accel-ppp/accel-ppp/blob/048d3… | technical-description |
| https://www.vulncheck.com/advisories/accel-ppp-be… | third-party-advisory |
Impacted products
Date Public
2026-10-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123205",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:35:40.023479Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:45:10.829Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/accel-ppp/accel-ppp",
"product": "accel-ppp",
"repo": "https://github.com/accel-ppp/accel-ppp",
"vendor": "accel-ppp",
"versions": [
{
"lessThan": "1.15.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:accel-ppp:accel-ppp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.15.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Deus Rex"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Denys Fedoryshchenko (nuclearcat)"
}
],
"datePublic": "2026-10-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "accel-ppp before 1.15.0 contains a heap buffer overflow vulnerability in the tcp, syslog and pgsql log targets that allows unauthenticated remote peers to overflow fixed heap buffers by producing log lines exceeding LOG_MAX_SIZE. Attackers within client-ip-range can send an L2TP Start-Control-Connection-Request with many string AVPs when verbose logging is enabled to corrupt heap memory and crash the daemon."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T18:16:40.464Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/accel-ppp/accel-ppp/pull/374"
},
{
"tags": [
"patch"
],
"url": "https://github.com/accel-ppp/accel-ppp/commit/58e399400c4ef4b71472ab7c2c71c54a677a05a8"
},
{
"name": "accel-ppp 1.15.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/accel-ppp/accel-ppp/releases/tag/1.15.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/accel-ppp/accel-ppp/blob/048d31cb446879e0d1a1471b4ab99135a92bf289/accel-pppd/logs/log_tcp.c#L55-L67"
},
{
"name": "VulnCheck Advisory: accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsql",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/accel-ppp-before-1.15.0-heap-based-buffer-overflow-via-oversized-log-lines-in-log-tcp-log-syslog-log-pgsql"
}
],
"title": "accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsql",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123205",
"datePublished": "2026-11-05T18:16:40.464Z",
"dateReserved": "2026-11-05T17:58:51.544Z",
"dateUpdated": "2026-11-09T17:45:10.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-42870 (GCVE-0-2021-42870)
Vulnerability from nvd – Published: 2022-05-16 14:01 – Updated: 2024-08-04 03:38
VLAI
EPSS
VEX
Summary
ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/xebd/accel-ppp/issues/158 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:38:50.134Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/xebd/accel-ppp/issues/158"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-16T14:01:21.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xebd/accel-ppp/issues/158"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-42870",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/xebd/accel-ppp/issues/158",
"refsource": "MISC",
"url": "https://github.com/xebd/accel-ppp/issues/158"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-42870",
"datePublished": "2022-05-16T14:01:21.000Z",
"dateReserved": "2021-10-25T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:38:50.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0982 (GCVE-0-2022-0982)
Vulnerability from nvd – Published: 2022-03-16 14:04 – Updated: 2024-09-17 04:20
VLAI
EPSS
VEX
Title
Buffer Overflow via crafted client request in Accel-PPP v1.12
Summary
The telnet_input_char function in opt/src/accel-pppd/cli/telnet.c suffers from a memory corruption vulnerability, whereby user input cmdline_len is copied into a fixed buffer b->buf without any bound checks. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability.
Severity
No CVSS data available.
CWE
- https://cwe.mitre.org/data/definitions/120.html
Assigner
GovTech CSG
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/xebd/accel-ppp/issues/164 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| https://accel-ppp.org/ | Accel-PPP |
Affected:
1.12 , ≤ 1.12
(custom)
|
Date Public
2022-03-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:47:42.845Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/xebd/accel-ppp/issues/164"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Accel-PPP",
"vendor": "https://accel-ppp.org/",
"versions": [
{
"lessThanOrEqual": "1.12",
"status": "affected",
"version": "1.12",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Chloe Ong from Government Technology Agency of Singapore"
},
{
"lang": "en",
"value": "Eugene Lim from Government Technology Agency of Singapore"
}
],
"datePublic": "2022-03-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The telnet_input_char function in opt/src/accel-pppd/cli/telnet.c suffers from a memory corruption vulnerability, whereby user input cmdline_len is copied into a fixed buffer b-\u003ebuf without any bound checks. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "https://cwe.mitre.org/data/definitions/120.html",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-16T14:04:22.000Z",
"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
"shortName": "GovTech CSG"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xebd/accel-ppp/issues/164"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Buffer Overflow via crafted client request in Accel-PPP v1.12",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve_disclosure@tech.gov.sg",
"DATE_PUBLIC": "2022-03-15T09:32:00.000Z",
"ID": "CVE-2022-0982",
"STATE": "PUBLIC",
"TITLE": "Buffer Overflow via crafted client request in Accel-PPP v1.12"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Accel-PPP",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "1.12",
"version_value": "1.12"
}
]
}
}
]
},
"vendor_name": "https://accel-ppp.org/"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Chloe Ong from Government Technology Agency of Singapore"
},
{
"lang": "eng",
"value": "Eugene Lim from Government Technology Agency of Singapore"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The telnet_input_char function in opt/src/accel-pppd/cli/telnet.c suffers from a memory corruption vulnerability, whereby user input cmdline_len is copied into a fixed buffer b-\u003ebuf without any bound checks. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "https://cwe.mitre.org/data/definitions/120.html"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/xebd/accel-ppp/issues/164",
"refsource": "MISC",
"url": "https://github.com/xebd/accel-ppp/issues/164"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
"assignerShortName": "GovTech CSG",
"cveId": "CVE-2022-0982",
"datePublished": "2022-03-16T14:04:22.485Z",
"dateReserved": "2022-03-15T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:20:24.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-24705 (GCVE-0-2022-24705)
Vulnerability from nvd – Published: 2022-02-14 21:04 – Updated: 2024-09-16 18:39
VLAI
EPSS
VEX
Title
Buffer Overflow via Crafted Ipv6 Prefix Attribute Type Client Request in accel-ppp v1.12
Summary
The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recvfrom into a fixed buffer that causes a buffer overflow and overwrites arbitrary memory. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability.
Severity
No CVSS data available.
CWE
- https://cwe.mitre.org/data/definitions/120.html
Assigner
GovTech CSG
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/accel-ppp/accel-ppp/pull/35 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| https://accel-ppp.org/ | accel-ppp |
Affected:
1.12 , ≤ 1.12
(custom)
|
Date Public
2022-02-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T04:20:50.205Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/accel-ppp/accel-ppp/pull/35"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "accel-ppp",
"vendor": "https://accel-ppp.org/",
"versions": [
{
"lessThanOrEqual": "1.12",
"status": "affected",
"version": "1.12",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Chloe Ong from Government Technology Agency of Singapore"
},
{
"lang": "en",
"value": "Eugene Lim from Government Technology Agency of Singapore"
},
{
"lang": "en",
"value": "Kar Wei Loh from Government Technology Agency of Singapore"
}
],
"datePublic": "2022-02-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recvfrom into a fixed buffer that causes a buffer overflow and overwrites arbitrary memory. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "https://cwe.mitre.org/data/definitions/120.html",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-14T21:04:30.000Z",
"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
"shortName": "GovTech CSG"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/accel-ppp/accel-ppp/pull/35"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Buffer Overflow via Crafted Ipv6 Prefix Attribute Type Client Request in accel-ppp v1.12",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve_disclosure@tech.gov.sg",
"DATE_PUBLIC": "2022-02-10T07:32:00.000Z",
"ID": "CVE-2022-24705",
"STATE": "PUBLIC",
"TITLE": "Buffer Overflow via Crafted Ipv6 Prefix Attribute Type Client Request in accel-ppp v1.12"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "accel-ppp",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "1.12",
"version_value": "1.12"
}
]
}
}
]
},
"vendor_name": "https://accel-ppp.org/"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Chloe Ong from Government Technology Agency of Singapore"
},
{
"lang": "eng",
"value": "Eugene Lim from Government Technology Agency of Singapore"
},
{
"lang": "eng",
"value": "Kar Wei Loh from Government Technology Agency of Singapore"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recvfrom into a fixed buffer that causes a buffer overflow and overwrites arbitrary memory. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "https://cwe.mitre.org/data/definitions/120.html"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/accel-ppp/accel-ppp/pull/35",
"refsource": "MISC",
"url": "https://github.com/accel-ppp/accel-ppp/pull/35"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
"assignerShortName": "GovTech CSG",
"cveId": "CVE-2022-24705",
"datePublished": "2022-02-14T21:04:30.848Z",
"dateReserved": "2022-02-10T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:39:19.344Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-24704 (GCVE-0-2022-24704)
Vulnerability from nvd – Published: 2022-02-14 21:04 – Updated: 2024-09-16 19:00
VLAI
EPSS
VEX
Title
Buffer Overflow via Crafted IPv6 Addr Attribute Type Client Request in Accel-PPP v1.12
Summary
The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby user input len is copied into a fixed buffer &attr->val.integer without any bound checks. If the client connects to the server and sends a large radius packet, a buffer overflow vulnerability will be triggered.
Severity
No CVSS data available.
CWE
- https://cwe.mitre.org/data/definitions/120.html
Assigner
GovTech CSG
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/accel-ppp/accel-ppp/pull/35 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| https://accel-ppp.org/ | Accel-PPP |
Affected:
1.12 , ≤ 1.12
(custom)
|
Date Public
2022-02-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T04:20:50.190Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/accel-ppp/accel-ppp/pull/35"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Accel-PPP",
"vendor": "https://accel-ppp.org/",
"versions": [
{
"lessThanOrEqual": "1.12",
"status": "affected",
"version": "1.12",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Chloe Ong from Government Technology Agency of Singapore"
},
{
"lang": "en",
"value": "Eugene Lim from Government Technology Agency of Singapore"
},
{
"lang": "en",
"value": "Kar Wei Loh from Government Technology Agency of Singapore"
}
],
"datePublic": "2022-02-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby user input len is copied into a fixed buffer \u0026attr-\u003eval.integer without any bound checks. If the client connects to the server and sends a large radius packet, a buffer overflow vulnerability will be triggered."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "https://cwe.mitre.org/data/definitions/120.html",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-14T21:04:29.000Z",
"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
"shortName": "GovTech CSG"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/accel-ppp/accel-ppp/pull/35"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Buffer Overflow via Crafted IPv6 Addr Attribute Type Client Request in Accel-PPP v1.12",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve_disclosure@tech.gov.sg",
"DATE_PUBLIC": "2022-02-10T07:47:00.000Z",
"ID": "CVE-2022-24704",
"STATE": "PUBLIC",
"TITLE": "Buffer Overflow via Crafted IPv6 Addr Attribute Type Client Request in Accel-PPP v1.12"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Accel-PPP",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "1.12",
"version_value": "1.12"
}
]
}
}
]
},
"vendor_name": "https://accel-ppp.org/"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Chloe Ong from Government Technology Agency of Singapore"
},
{
"lang": "eng",
"value": "Eugene Lim from Government Technology Agency of Singapore"
},
{
"lang": "eng",
"value": "Kar Wei Loh from Government Technology Agency of Singapore"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby user input len is copied into a fixed buffer \u0026attr-\u003eval.integer without any bound checks. If the client connects to the server and sends a large radius packet, a buffer overflow vulnerability will be triggered."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "https://cwe.mitre.org/data/definitions/120.html"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/accel-ppp/accel-ppp/pull/35",
"refsource": "MISC",
"url": "https://github.com/accel-ppp/accel-ppp/pull/35"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
"assignerShortName": "GovTech CSG",
"cveId": "CVE-2022-24704",
"datePublished": "2022-02-14T21:04:29.942Z",
"dateReserved": "2022-02-10T00:00:00.000Z",
"dateUpdated": "2024-09-16T19:00:04.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42054 (GCVE-0-2021-42054)
Vulnerability from nvd – Published: 2021-10-07 05:28 – Updated: 2024-08-04 03:22
VLAI
EPSS
VEX
Summary
ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/xebd/accel-ppp/issues/156 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:22:26.046Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/xebd/accel-ppp/issues/156"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-07T05:28:57.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xebd/accel-ppp/issues/156"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-42054",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/xebd/accel-ppp/issues/156",
"refsource": "MISC",
"url": "https://github.com/xebd/accel-ppp/issues/156"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-42054",
"datePublished": "2021-10-07T05:28:57.000Z",
"dateReserved": "2021-10-07T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:22:26.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-28194 (GCVE-0-2020-28194)
Vulnerability from nvd – Published: 2021-02-01 13:13 – Updated: 2024-08-04 16:33
VLAI
EPSS
VEX
Summary
Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/accel-ppp/accel-ppp/security/a… | x_refsource_MISC |
| https://github.com/accel-ppp/accel-ppp/commit/e9d… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T16:33:58.925Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-2m44-rh3c-x4gr"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/accel-ppp/accel-ppp/commit/e9d369aa0054312b7633e964e9f7eb323f1f3d69"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-02T13:35:08.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-2m44-rh3c-x4gr"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/accel-ppp/accel-ppp/commit/e9d369aa0054312b7633e964e9f7eb323f1f3d69"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-28194",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-2m44-rh3c-x4gr",
"refsource": "MISC",
"url": "https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-2m44-rh3c-x4gr"
},
{
"name": "https://github.com/accel-ppp/accel-ppp/commit/e9d369aa0054312b7633e964e9f7eb323f1f3d69",
"refsource": "MISC",
"url": "https://github.com/accel-ppp/accel-ppp/commit/e9d369aa0054312b7633e964e9f7eb323f1f3d69"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-28194",
"datePublished": "2021-02-01T13:13:47.000Z",
"dateReserved": "2020-11-02T00:00:00.000Z",
"dateUpdated": "2024-08-04T16:33:58.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-15173 (GCVE-0-2020-15173)
Vulnerability from nvd – Published: 2020-09-09 22:45 – Updated: 2024-08-04 13:08
VLAI
EPSS
VEX
Title
Heap buffer overflow in ACCEL-PPP
Summary
In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), there is a buffer overflow when receiving an l2tp control packet ith an AVP which type is a string and no hidden flags, length set to less than 6. If your application is used in open networks or there are untrusted nodes in the network it is highly recommended to apply the patch. The problem was patched with commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b As a workaround changes of commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b can be applied to older versions.
Severity
8.2 (High)
CWE
- CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/accel-ppp/accel-ppp/security/a… | x_refsource_CONFIRM |
| https://github.com/accel-ppp/accel-ppp/commit/232… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:08:22.404Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-rr68-fchr-69vf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/accel-ppp/accel-ppp/commit/2324bcd5ba12cf28f47357a8f03cd41b7c04c52b"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "accel-ppp",
"vendor": "accel-ppp",
"versions": [
{
"status": "affected",
"version": "\u003c= 1.12.0-92-g38b6104"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), there is a buffer overflow when receiving an l2tp control packet ith an AVP which type is a string and no hidden flags, length set to less than 6. If your application is used in open networks or there are untrusted nodes in the network it is highly recommended to apply the patch. The problem was patched with commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b As a workaround changes of commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b can be applied to older versions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-09T22:45:13.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-rr68-fchr-69vf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/accel-ppp/accel-ppp/commit/2324bcd5ba12cf28f47357a8f03cd41b7c04c52b"
}
],
"source": {
"advisory": "GHSA-rr68-fchr-69vf",
"discovery": "UNKNOWN"
},
"title": "Heap buffer overflow in ACCEL-PPP",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-15173",
"STATE": "PUBLIC",
"TITLE": "Heap buffer overflow in ACCEL-PPP"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "accel-ppp",
"version": {
"version_data": [
{
"version_value": "\u003c= 1.12.0-92-g38b6104"
}
]
}
}
]
},
"vendor_name": "accel-ppp"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), there is a buffer overflow when receiving an l2tp control packet ith an AVP which type is a string and no hidden flags, length set to less than 6. If your application is used in open networks or there are untrusted nodes in the network it is highly recommended to apply the patch. The problem was patched with commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b As a workaround changes of commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b can be applied to older versions."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-rr68-fchr-69vf",
"refsource": "CONFIRM",
"url": "https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-rr68-fchr-69vf"
},
{
"name": "https://github.com/accel-ppp/accel-ppp/commit/2324bcd5ba12cf28f47357a8f03cd41b7c04c52b",
"refsource": "MISC",
"url": "https://github.com/accel-ppp/accel-ppp/commit/2324bcd5ba12cf28f47357a8f03cd41b7c04c52b"
}
]
},
"source": {
"advisory": "GHSA-rr68-fchr-69vf",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-15173",
"datePublished": "2020-09-09T22:45:13.000Z",
"dateReserved": "2020-06-25T00:00:00.000Z",
"dateUpdated": "2024-08-04T13:08:22.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-123205 (GCVE-0-2026-123205)
Vulnerability from cvelistv5 – Published: 2026-11-05 18:16 – Updated: 2026-11-09 17:45
VLAI
EPSS
VEX
Title
accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsql
Summary
accel-ppp before 1.15.0 contains a heap buffer overflow vulnerability in the tcp, syslog and pgsql log targets that allows unauthenticated remote peers to overflow fixed heap buffers by producing log lines exceeding LOG_MAX_SIZE. Attackers within client-ip-range can send an L2TP Start-Control-Connection-Request with many string AVPs when verbose logging is enabled to corrupt heap memory and crash the daemon.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:35 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/accel-ppp/accel-ppp/pull/374 | issue-trackingpatch |
| https://github.com/accel-ppp/accel-ppp/commit/58e… | patch |
| https://github.com/accel-ppp/accel-ppp/releases/t… | release-notes |
| https://github.com/accel-ppp/accel-ppp/blob/048d3… | technical-description |
| https://www.vulncheck.com/advisories/accel-ppp-be… | third-party-advisory |
Impacted products
Date Public
2026-10-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123205",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:35:40.023479Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:45:10.829Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/accel-ppp/accel-ppp",
"product": "accel-ppp",
"repo": "https://github.com/accel-ppp/accel-ppp",
"vendor": "accel-ppp",
"versions": [
{
"lessThan": "1.15.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:accel-ppp:accel-ppp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.15.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Deus Rex"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Denys Fedoryshchenko (nuclearcat)"
}
],
"datePublic": "2026-10-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "accel-ppp before 1.15.0 contains a heap buffer overflow vulnerability in the tcp, syslog and pgsql log targets that allows unauthenticated remote peers to overflow fixed heap buffers by producing log lines exceeding LOG_MAX_SIZE. Attackers within client-ip-range can send an L2TP Start-Control-Connection-Request with many string AVPs when verbose logging is enabled to corrupt heap memory and crash the daemon."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T18:16:40.464Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/accel-ppp/accel-ppp/pull/374"
},
{
"tags": [
"patch"
],
"url": "https://github.com/accel-ppp/accel-ppp/commit/58e399400c4ef4b71472ab7c2c71c54a677a05a8"
},
{
"name": "accel-ppp 1.15.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/accel-ppp/accel-ppp/releases/tag/1.15.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/accel-ppp/accel-ppp/blob/048d31cb446879e0d1a1471b4ab99135a92bf289/accel-pppd/logs/log_tcp.c#L55-L67"
},
{
"name": "VulnCheck Advisory: accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsql",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/accel-ppp-before-1.15.0-heap-based-buffer-overflow-via-oversized-log-lines-in-log-tcp-log-syslog-log-pgsql"
}
],
"title": "accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsql",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123205",
"datePublished": "2026-11-05T18:16:40.464Z",
"dateReserved": "2026-11-05T17:58:51.544Z",
"dateUpdated": "2026-11-09T17:45:10.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-42870 (GCVE-0-2021-42870)
Vulnerability from cvelistv5 – Published: 2022-05-16 14:01 – Updated: 2024-08-04 03:38
VLAI
EPSS
VEX
Summary
ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/xebd/accel-ppp/issues/158 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:38:50.134Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/xebd/accel-ppp/issues/158"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-16T14:01:21.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xebd/accel-ppp/issues/158"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-42870",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/xebd/accel-ppp/issues/158",
"refsource": "MISC",
"url": "https://github.com/xebd/accel-ppp/issues/158"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-42870",
"datePublished": "2022-05-16T14:01:21.000Z",
"dateReserved": "2021-10-25T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:38:50.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0982 (GCVE-0-2022-0982)
Vulnerability from cvelistv5 – Published: 2022-03-16 14:04 – Updated: 2024-09-17 04:20
VLAI
EPSS
VEX
Title
Buffer Overflow via crafted client request in Accel-PPP v1.12
Summary
The telnet_input_char function in opt/src/accel-pppd/cli/telnet.c suffers from a memory corruption vulnerability, whereby user input cmdline_len is copied into a fixed buffer b->buf without any bound checks. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability.
Severity
No CVSS data available.
CWE
- https://cwe.mitre.org/data/definitions/120.html
Assigner
GovTech CSG
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/xebd/accel-ppp/issues/164 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| https://accel-ppp.org/ | Accel-PPP |
Affected:
1.12 , ≤ 1.12
(custom)
|
Date Public
2022-03-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:47:42.845Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/xebd/accel-ppp/issues/164"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Accel-PPP",
"vendor": "https://accel-ppp.org/",
"versions": [
{
"lessThanOrEqual": "1.12",
"status": "affected",
"version": "1.12",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Chloe Ong from Government Technology Agency of Singapore"
},
{
"lang": "en",
"value": "Eugene Lim from Government Technology Agency of Singapore"
}
],
"datePublic": "2022-03-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The telnet_input_char function in opt/src/accel-pppd/cli/telnet.c suffers from a memory corruption vulnerability, whereby user input cmdline_len is copied into a fixed buffer b-\u003ebuf without any bound checks. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "https://cwe.mitre.org/data/definitions/120.html",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-16T14:04:22.000Z",
"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
"shortName": "GovTech CSG"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xebd/accel-ppp/issues/164"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Buffer Overflow via crafted client request in Accel-PPP v1.12",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve_disclosure@tech.gov.sg",
"DATE_PUBLIC": "2022-03-15T09:32:00.000Z",
"ID": "CVE-2022-0982",
"STATE": "PUBLIC",
"TITLE": "Buffer Overflow via crafted client request in Accel-PPP v1.12"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Accel-PPP",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "1.12",
"version_value": "1.12"
}
]
}
}
]
},
"vendor_name": "https://accel-ppp.org/"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Chloe Ong from Government Technology Agency of Singapore"
},
{
"lang": "eng",
"value": "Eugene Lim from Government Technology Agency of Singapore"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The telnet_input_char function in opt/src/accel-pppd/cli/telnet.c suffers from a memory corruption vulnerability, whereby user input cmdline_len is copied into a fixed buffer b-\u003ebuf without any bound checks. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "https://cwe.mitre.org/data/definitions/120.html"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/xebd/accel-ppp/issues/164",
"refsource": "MISC",
"url": "https://github.com/xebd/accel-ppp/issues/164"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
"assignerShortName": "GovTech CSG",
"cveId": "CVE-2022-0982",
"datePublished": "2022-03-16T14:04:22.485Z",
"dateReserved": "2022-03-15T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:20:24.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-24705 (GCVE-0-2022-24705)
Vulnerability from cvelistv5 – Published: 2022-02-14 21:04 – Updated: 2024-09-16 18:39
VLAI
EPSS
VEX
Title
Buffer Overflow via Crafted Ipv6 Prefix Attribute Type Client Request in accel-ppp v1.12
Summary
The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recvfrom into a fixed buffer that causes a buffer overflow and overwrites arbitrary memory. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability.
Severity
No CVSS data available.
CWE
- https://cwe.mitre.org/data/definitions/120.html
Assigner
GovTech CSG
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/accel-ppp/accel-ppp/pull/35 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| https://accel-ppp.org/ | accel-ppp |
Affected:
1.12 , ≤ 1.12
(custom)
|
Date Public
2022-02-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T04:20:50.205Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/accel-ppp/accel-ppp/pull/35"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "accel-ppp",
"vendor": "https://accel-ppp.org/",
"versions": [
{
"lessThanOrEqual": "1.12",
"status": "affected",
"version": "1.12",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Chloe Ong from Government Technology Agency of Singapore"
},
{
"lang": "en",
"value": "Eugene Lim from Government Technology Agency of Singapore"
},
{
"lang": "en",
"value": "Kar Wei Loh from Government Technology Agency of Singapore"
}
],
"datePublic": "2022-02-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recvfrom into a fixed buffer that causes a buffer overflow and overwrites arbitrary memory. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "https://cwe.mitre.org/data/definitions/120.html",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-14T21:04:30.000Z",
"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
"shortName": "GovTech CSG"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/accel-ppp/accel-ppp/pull/35"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Buffer Overflow via Crafted Ipv6 Prefix Attribute Type Client Request in accel-ppp v1.12",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve_disclosure@tech.gov.sg",
"DATE_PUBLIC": "2022-02-10T07:32:00.000Z",
"ID": "CVE-2022-24705",
"STATE": "PUBLIC",
"TITLE": "Buffer Overflow via Crafted Ipv6 Prefix Attribute Type Client Request in accel-ppp v1.12"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "accel-ppp",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "1.12",
"version_value": "1.12"
}
]
}
}
]
},
"vendor_name": "https://accel-ppp.org/"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Chloe Ong from Government Technology Agency of Singapore"
},
{
"lang": "eng",
"value": "Eugene Lim from Government Technology Agency of Singapore"
},
{
"lang": "eng",
"value": "Kar Wei Loh from Government Technology Agency of Singapore"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recvfrom into a fixed buffer that causes a buffer overflow and overwrites arbitrary memory. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "https://cwe.mitre.org/data/definitions/120.html"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/accel-ppp/accel-ppp/pull/35",
"refsource": "MISC",
"url": "https://github.com/accel-ppp/accel-ppp/pull/35"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
"assignerShortName": "GovTech CSG",
"cveId": "CVE-2022-24705",
"datePublished": "2022-02-14T21:04:30.848Z",
"dateReserved": "2022-02-10T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:39:19.344Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-24704 (GCVE-0-2022-24704)
Vulnerability from cvelistv5 – Published: 2022-02-14 21:04 – Updated: 2024-09-16 19:00
VLAI
EPSS
VEX
Title
Buffer Overflow via Crafted IPv6 Addr Attribute Type Client Request in Accel-PPP v1.12
Summary
The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby user input len is copied into a fixed buffer &attr->val.integer without any bound checks. If the client connects to the server and sends a large radius packet, a buffer overflow vulnerability will be triggered.
Severity
No CVSS data available.
CWE
- https://cwe.mitre.org/data/definitions/120.html
Assigner
GovTech CSG
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/accel-ppp/accel-ppp/pull/35 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| https://accel-ppp.org/ | Accel-PPP |
Affected:
1.12 , ≤ 1.12
(custom)
|
Date Public
2022-02-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T04:20:50.190Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/accel-ppp/accel-ppp/pull/35"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Accel-PPP",
"vendor": "https://accel-ppp.org/",
"versions": [
{
"lessThanOrEqual": "1.12",
"status": "affected",
"version": "1.12",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Chloe Ong from Government Technology Agency of Singapore"
},
{
"lang": "en",
"value": "Eugene Lim from Government Technology Agency of Singapore"
},
{
"lang": "en",
"value": "Kar Wei Loh from Government Technology Agency of Singapore"
}
],
"datePublic": "2022-02-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby user input len is copied into a fixed buffer \u0026attr-\u003eval.integer without any bound checks. If the client connects to the server and sends a large radius packet, a buffer overflow vulnerability will be triggered."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "https://cwe.mitre.org/data/definitions/120.html",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-14T21:04:29.000Z",
"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
"shortName": "GovTech CSG"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/accel-ppp/accel-ppp/pull/35"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Buffer Overflow via Crafted IPv6 Addr Attribute Type Client Request in Accel-PPP v1.12",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve_disclosure@tech.gov.sg",
"DATE_PUBLIC": "2022-02-10T07:47:00.000Z",
"ID": "CVE-2022-24704",
"STATE": "PUBLIC",
"TITLE": "Buffer Overflow via Crafted IPv6 Addr Attribute Type Client Request in Accel-PPP v1.12"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Accel-PPP",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "1.12",
"version_value": "1.12"
}
]
}
}
]
},
"vendor_name": "https://accel-ppp.org/"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Chloe Ong from Government Technology Agency of Singapore"
},
{
"lang": "eng",
"value": "Eugene Lim from Government Technology Agency of Singapore"
},
{
"lang": "eng",
"value": "Kar Wei Loh from Government Technology Agency of Singapore"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby user input len is copied into a fixed buffer \u0026attr-\u003eval.integer without any bound checks. If the client connects to the server and sends a large radius packet, a buffer overflow vulnerability will be triggered."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "https://cwe.mitre.org/data/definitions/120.html"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/accel-ppp/accel-ppp/pull/35",
"refsource": "MISC",
"url": "https://github.com/accel-ppp/accel-ppp/pull/35"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
"assignerShortName": "GovTech CSG",
"cveId": "CVE-2022-24704",
"datePublished": "2022-02-14T21:04:29.942Z",
"dateReserved": "2022-02-10T00:00:00.000Z",
"dateUpdated": "2024-09-16T19:00:04.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42054 (GCVE-0-2021-42054)
Vulnerability from cvelistv5 – Published: 2021-10-07 05:28 – Updated: 2024-08-04 03:22
VLAI
EPSS
VEX
Summary
ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/xebd/accel-ppp/issues/156 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:22:26.046Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/xebd/accel-ppp/issues/156"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-07T05:28:57.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xebd/accel-ppp/issues/156"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-42054",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/xebd/accel-ppp/issues/156",
"refsource": "MISC",
"url": "https://github.com/xebd/accel-ppp/issues/156"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-42054",
"datePublished": "2021-10-07T05:28:57.000Z",
"dateReserved": "2021-10-07T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:22:26.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-28194 (GCVE-0-2020-28194)
Vulnerability from cvelistv5 – Published: 2021-02-01 13:13 – Updated: 2024-08-04 16:33
VLAI
EPSS
VEX
Summary
Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/accel-ppp/accel-ppp/security/a… | x_refsource_MISC |
| https://github.com/accel-ppp/accel-ppp/commit/e9d… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T16:33:58.925Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-2m44-rh3c-x4gr"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/accel-ppp/accel-ppp/commit/e9d369aa0054312b7633e964e9f7eb323f1f3d69"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-02T13:35:08.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-2m44-rh3c-x4gr"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/accel-ppp/accel-ppp/commit/e9d369aa0054312b7633e964e9f7eb323f1f3d69"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-28194",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-2m44-rh3c-x4gr",
"refsource": "MISC",
"url": "https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-2m44-rh3c-x4gr"
},
{
"name": "https://github.com/accel-ppp/accel-ppp/commit/e9d369aa0054312b7633e964e9f7eb323f1f3d69",
"refsource": "MISC",
"url": "https://github.com/accel-ppp/accel-ppp/commit/e9d369aa0054312b7633e964e9f7eb323f1f3d69"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-28194",
"datePublished": "2021-02-01T13:13:47.000Z",
"dateReserved": "2020-11-02T00:00:00.000Z",
"dateUpdated": "2024-08-04T16:33:58.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-15173 (GCVE-0-2020-15173)
Vulnerability from cvelistv5 – Published: 2020-09-09 22:45 – Updated: 2024-08-04 13:08
VLAI
EPSS
VEX
Title
Heap buffer overflow in ACCEL-PPP
Summary
In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), there is a buffer overflow when receiving an l2tp control packet ith an AVP which type is a string and no hidden flags, length set to less than 6. If your application is used in open networks or there are untrusted nodes in the network it is highly recommended to apply the patch. The problem was patched with commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b As a workaround changes of commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b can be applied to older versions.
Severity
8.2 (High)
CWE
- CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/accel-ppp/accel-ppp/security/a… | x_refsource_CONFIRM |
| https://github.com/accel-ppp/accel-ppp/commit/232… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:08:22.404Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-rr68-fchr-69vf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/accel-ppp/accel-ppp/commit/2324bcd5ba12cf28f47357a8f03cd41b7c04c52b"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "accel-ppp",
"vendor": "accel-ppp",
"versions": [
{
"status": "affected",
"version": "\u003c= 1.12.0-92-g38b6104"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), there is a buffer overflow when receiving an l2tp control packet ith an AVP which type is a string and no hidden flags, length set to less than 6. If your application is used in open networks or there are untrusted nodes in the network it is highly recommended to apply the patch. The problem was patched with commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b As a workaround changes of commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b can be applied to older versions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-09T22:45:13.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-rr68-fchr-69vf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/accel-ppp/accel-ppp/commit/2324bcd5ba12cf28f47357a8f03cd41b7c04c52b"
}
],
"source": {
"advisory": "GHSA-rr68-fchr-69vf",
"discovery": "UNKNOWN"
},
"title": "Heap buffer overflow in ACCEL-PPP",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-15173",
"STATE": "PUBLIC",
"TITLE": "Heap buffer overflow in ACCEL-PPP"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "accel-ppp",
"version": {
"version_data": [
{
"version_value": "\u003c= 1.12.0-92-g38b6104"
}
]
}
}
]
},
"vendor_name": "accel-ppp"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), there is a buffer overflow when receiving an l2tp control packet ith an AVP which type is a string and no hidden flags, length set to less than 6. If your application is used in open networks or there are untrusted nodes in the network it is highly recommended to apply the patch. The problem was patched with commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b As a workaround changes of commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b can be applied to older versions."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-rr68-fchr-69vf",
"refsource": "CONFIRM",
"url": "https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-rr68-fchr-69vf"
},
{
"name": "https://github.com/accel-ppp/accel-ppp/commit/2324bcd5ba12cf28f47357a8f03cd41b7c04c52b",
"refsource": "MISC",
"url": "https://github.com/accel-ppp/accel-ppp/commit/2324bcd5ba12cf28f47357a8f03cd41b7c04c52b"
}
]
},
"source": {
"advisory": "GHSA-rr68-fchr-69vf",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-15173",
"datePublished": "2020-09-09T22:45:13.000Z",
"dateReserved": "2020-06-25T00:00:00.000Z",
"dateUpdated": "2024-08-04T13:08:22.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}