Vulnerability-Lookup

CVE-2020-29362 (GCVE-0-2020-29362)

Vulnerability from cvelistv5 – Published: 2020-12-16 13:32 – Updated: 2026-10-14 09:40

Summary

An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2290 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/p11-glue/p11-kit/releases	x_refsource_MISC
https://github.com/p11-glue/p11-kit/security/advi…	x_refsource_MISC
https://www.debian.org/security/2021/dsa-4822	vendor-advisoryx_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version	CPE status
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.0 , < V3.1.5 (custom)	guessed
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.0 , < V3.1.5 (custom)	guessed
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.0 , < V3.1.5 (custom)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:48:01.647Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/p11-glue/p11-kit/releases"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5wpq-43j2-6qwc"
          },
          {
            "name": "DSA-4822",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4822"
          },
          {
            "name": "[debian-lts-announce] 20210104 [SECURITY] [DLA 2513-1] p11-kit security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T09:40:05.626Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-04T08:06:08.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/p11-glue/p11-kit/releases"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5wpq-43j2-6qwc"
        },
        {
          "name": "DSA-4822",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4822"
        },
        {
          "name": "[debian-lts-announce] 20210104 [SECURITY] [DLA 2513-1] p11-kit security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00002.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-29362",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/p11-glue/p11-kit/releases",
              "refsource": "MISC",
              "url": "https://github.com/p11-glue/p11-kit/releases"
            },
            {
              "name": "https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5wpq-43j2-6qwc",
              "refsource": "MISC",
              "url": "https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5wpq-43j2-6qwc"
            },
            {
              "name": "DSA-4822",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4822"
            },
            {
              "name": "[debian-lts-announce] 20210104 [SECURITY] [DLA 2513-1] p11-kit security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00002.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-29362",
    "datePublished": "2020-12-16T13:32:57.000Z",
    "dateReserved": "2020-11-27T00:00:00.000Z",
    "dateUpdated": "2026-10-14T09:40:05.626Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-29362",
      "date": "2026-11-01",
      "epss": "0.0227",
      "percentile": "0.83057"
    },
    "microsoft_vex": {
      "current_release_date": "2020-12-24T00:00:00.000Z",
      "cve": "CVE-2020-29362",
      "id": "msrc_CVE-2020-29362",
      "initial_release_date": "2020-12-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation.",
      "url": "https://msrc.microsoft.com/csaf/vex/2020/msrc_cve-2020-29362.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "n/a",
                "vendor": "n/a",
                "versions": [
                  {
                    "status": "affected",
                    "version": "n/a"
                  }
                ]
              }
            ],
            "source": "cve@mitre.org"
          },
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.1.5",
                    "status": "affected",
                    "version": "V3.1.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.1.5",
                    "status": "affected",
                    "version": "V3.1.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.1.5",
                    "status": "affected",
                    "version": "V3.1.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.1.5",
                    "status": "affected",
                    "version": "V3.1.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.1.5",
                    "status": "affected",
                    "version": "V3.1.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:p11-kit_project:p11-kit:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3592022A-B10B-479D-BFAD-94E4E6C2526F",
                    "versionEndExcluding": "0.23.22",
                    "versionStartIncluding": "0.23.6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation."
          },
          {
            "lang": "es",
            "value": "Se detect\u00f3 un problema en p11-kit versiones 0.21.1 hasta 0.23.21.\u0026#xa0;Se ha detectado una lectura excesiva de b\u00fafer en la regi\u00f3n heap de la memoria en el protocolo RPC usado por los comandos remotos del servidor p11-kit y la biblioteca cliente.\u0026#xa0;Cuando la entidad remota suministra una matriz de bytes por medio de una llamada de funci\u00f3n PKCS#11 serializada, la entidad receptora puede permitir la lectura de hasta 4 bytes de memoria m\u00e1s all\u00e1 de la asignaci\u00f3n de la pila"
          }
        ],
        "id": "CVE-2020-29362",
        "lastModified": "2026-10-14T10:17:34.647",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 5.0,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2020-12-16T14:15:12.777",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Release Notes",
              "Third Party Advisory"
            ],
            "url": "https://github.com/p11-glue/p11-kit/releases"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5wpq-43j2-6qwc"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00002.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4822"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes",
              "Third Party Advisory"
            ],
            "url": "https://github.com/p11-glue/p11-kit/releases"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5wpq-43j2-6qwc"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00002.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4822"
          },
          {
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-14T12:51:34+00:00",
      "cve": "CVE-2020-29362",
      "id": "CVE-2020-29362",
      "initial_release_date": "2020-12-12T00:00:00+00:00",
      "product_status:fixed": "40",
      "product_status:known_affected": "4",
      "product_status:known_not_affected": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "p11-kit: out-of-bounds read in p11_rpc_buffer_get_byte_array function in rpc-message.c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-29362.json",
      "version": "3"
    }
  }
}

RHSA-2021:1609

Vulnerability from csaf_opensuse - Published: 2021-05-18 15:27 - Updated: 2026-10-14 12:52

Summary

Red Hat Security Advisory: p11-kit security, bug fix, and enhancement update

Severity

Moderate

Scope

3 vulnerabilities in this advisory, including CVE-2020-29362.

CVE-2020-29362

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fixed: 40 products

https://access.redhat.com/errata/RHSA-2021:1609

Open the full advisory

SSA-398330

Vulnerability from csaf_siemens - Published: 2023-12-12 00:00 - Updated: 2026-10-13 00:00

Summary

SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5

Scope

544 vulnerabilities in this advisory, including CVE-2020-29362.

CVE-2020-29362

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

Known affected: 5 products

https://support.industry.siemens.com/cs/ww/en/view/109478459/

Open the full advisory

SUSE-SU-2022:2405-1

Vulnerability from csaf_suse - Published: 2022-07-15 09:48 - Updated: 2026-09-20 14:31

Summary

Security update for p11-kit

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2020-29362.

CVE-2020-29362

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Recommended: 231 products

Open the full advisory

SUSE-SU-2022:2405-2

Vulnerability from csaf_suse - Published: 2022-07-15 09:48 - Updated: 2026-09-20 14:31

Summary

Security update for p11-kit

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2020-29362.

CVE-2020-29362

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Recommended: 6 products

Open the full advisory

SUSE-SU-2022:2871-1

Vulnerability from csaf_suse - Published: 2022-08-23 07:26 - Updated: 2026-09-20 14:35

Summary

Security update for p11-kit

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2020-29362.

CVE-2020-29362

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Recommended: 32 products

Open the full advisory

UBUNTU-CVE-2020-29362 (CVE-2020-29362)

Vulnerability from osv_ubuntu – Published: 2020-12-16 14:15 – Updated: 2026-04-22 07:39 – Source website

Details

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2020-29362	REPORT
	https://lists.freedesktop.org/archives/p11-glue/2…	REPORT
	https://github.com/p11-glue/p11-kit/security/advi…	REPORT
	https://ubuntu.com/security/notices/USN-4677-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2020-29362	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libp11-kit0",
            "binary_version": "0.23.2-5~ubuntu16.04.2"
          },
          {
            "binary_name": "p11-kit",
            "binary_version": "0.23.2-5~ubuntu16.04.2"
          },
          {
            "binary_name": "p11-kit-modules",
            "binary_version": "0.23.2-5~ubuntu16.04.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "p11-kit",
        "purl": "pkg:deb/ubuntu/p11-kit@0.23.2-5~ubuntu16.04.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.2-5~ubuntu16.04.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.23.1-3",
        "0.23.2-2",
        "0.23.2-3",
        "0.23.2-5~ubuntu16.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libp11-kit0",
            "binary_version": "0.23.9-2ubuntu0.1"
          },
          {
            "binary_name": "p11-kit",
            "binary_version": "0.23.9-2ubuntu0.1"
          },
          {
            "binary_name": "p11-kit-modules",
            "binary_version": "0.23.9-2ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "p11-kit",
        "purl": "pkg:deb/ubuntu/p11-kit@0.23.9-2ubuntu0.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.9-2ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.23.7-3",
        "0.23.9-2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libp11-kit0",
            "binary_version": "0.23.20-1ubuntu0.1"
          },
          {
            "binary_name": "p11-kit",
            "binary_version": "0.23.20-1ubuntu0.1"
          },
          {
            "binary_name": "p11-kit-modules",
            "binary_version": "0.23.20-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "p11-kit",
        "purl": "pkg:deb/ubuntu/p11-kit@0.23.20-1ubuntu0.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.20-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.23.17-2",
        "0.23.18.1-2",
        "0.23.19-2",
        "0.23.20-1",
        "0.23.20-1build1"
      ]
    }
  ],
  "aliases": [],
  "details": "An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation.",
  "id": "UBUNTU-CVE-2020-29362",
  "modified": "2026-04-22T07:39:38Z",
  "published": "2020-12-16T14:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-29362"
    },
    {
      "type": "REPORT",
      "url": "https://lists.freedesktop.org/archives/p11-glue/2020-December/000712.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5wpq-43j2-6qwc"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-4677-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-29362"
    }
  ],
  "related": [
    "USN-4677-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2020-29362"
  ]
}

WID-SEC-W-2025-0227

Vulnerability from csaf_certbund - Published: 2021-11-30 23:00 - Updated: 2025-01-30 23:00

Summary

IBM QRadar SIEM: Mehrere Schwachstellen

Severity

Hoch

Scope

105 vulnerabilities in this advisory, including CVE-2020-29362.

CVE-2020-29362

In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Schwachstellen bestehen in verschiedenen Komponenten. Ein entfernter, anonymer oder authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, Administratorrechte zu erlangen, beliebigen Programmcode auszuführen, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.

Known affected: 3 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2020-29362 (GCVE-0-2020-29362)

RHSA-2021:1609

SSA-398330

SUSE-SU-2022:2405-1

SUSE-SU-2022:2405-2

SUSE-SU-2022:2871-1

UBUNTU-CVE-2020-29362 (CVE-2020-29362)

WID-SEC-W-2025-0227

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour