CVE-2020-8597 in the critical feed json
eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.
published 6y ago modified 4mo ago also EUVD-2020-29445
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 19.9%
- EPSS 19.9% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.
Patch / fix
- wago pfc_firmware 03.04.10\(16\)
- ppp Debian 14, Debian 13, Debian 12 2.4.8-1+1
- lwip Debian 14, Debian 13, Debian 12 2.1.2+dfsg1-5
debian advisories DEBIAN-CVE-2020-8597
- ppp Ubuntu 16.04 LTS 2.4.7-1+2ubuntu1.16.04.2
- ppp Ubuntu 18.04 LTS 2.4.7-2+2ubuntu1.2
- ppp Ubuntu 20.04 LTS 2.4.7-2+4.1ubuntu5
- ppp Ubuntu Pro 14.04 LTS 2.4.5-5.1ubuntu2.3+esm1
- lwip Ubuntu Pro 20.04 LTS 2.1.2+dfsg1-4ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2020-8597
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- ppp RHEL 6 2.4.5-11.el6_10
- ppp RHEL 7 2.4.5-34.el7_7
- ppp RHEL 8 2.4.7-26.el8_1
- network-scripts-ppp RHEL 8 2.4.7-26.el8_1
- ppp RHEL 8.0 E4S 2.4.7-26.el8_0
red hat advisories RHSA-2020:0631RHSA-2020:0630RHSA-2020:0634RHSA-2020:0633
- ppp SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +17 more 2.4.7-4.3.1
- ppp SLE Module for Desktop Applications 15 SP1, SLE Module for Desktop Applications 15 2.4.7-5.3.1
- ppp SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 2.4.5.git-2.32.3.1
suse advisories SUSE-SU-2020:0490-1SUSE-SU-2020:0489-1SUSE-SU-2020:14292-1
- ppp openSUSE Tumbleweed 2.4.8-3.6
- ppp openSUSE Leap 15.1 2.4.7-lp151.5.3.1
opensuse advisories openSUSE-SU-2024:11191-1openSUSE-SU-2020:0286-1
- ppp AlmaLinux 8 2.4.7-26.el8_1
almalinux advisories ALSA-2020:0633
- ppp Rocky Linux 8 2.4.7-26.el8_1
rocky linux advisories RLSA-2020:0633
- ppp Alpine 3.11, Alpine 3.10, Alpine 3.9 +1 more 2.4.7-r7
- ppp Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 2.4.8-r1
alpine advisories ALPINE-CVE-2020-8597
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- ppp Azure Linux 3.0 2.4.7-36
azure linux advisories AZL-45009
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- ppp Arch Linux 2.4.7-7
arch linux advisories AVG-1101
Is CVE-2020-8597 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2020-8597 updated cvss 9.8
ppp: Buffer overflow in the eap_request and eap_response functions in eap.c
-
Red Hat Enterprise Linux 5 pppaffected: workaround, no fix planned “Out of support scope”
-
Red Hat CodeReady Linux Builder (v. 8) ppp 2.4.7-26.el8_1 Red Hat Enterprise Linux AppStream (v. 8) network-scripts-ppp 2.4.7-26.el8_1 Red Hat Enterprise Linux BaseOS (v. 8) ppp 2.4.7-26.el8_1fixed: vendor fix RHSA-2020:0633
-
Red Hat Enterprise Linux BaseOS E4S (v. 8.0) ppp 2.4.7-26.el8_0fixed: vendor fix RHSA-2020:0634
-
Red Hat Enterprise Linux Client (v. 7) ppp 2.4.5-34.el7_7 Red Hat Enterprise Linux Client Optional (v. 7) ppp-devel 2.4.5-34.el7_7, ppp-debuginfo 2.4.5-34.el7_7 Red Hat Enterprise Linux ComputeNode (v. 7) ppp 2.4.5-34.el7_7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) ppp-devel 2.4.5-34.el7_7, ppp-debuginfo 2.4.5-34.el7_7fixed: vendor fix RHSA-2020:0630
-
Red Hat Enterprise Linux Desktop (v. 6) ppp 2.4.5-11.el6_10 Red Hat Enterprise Linux Desktop Optional (v. 6) ppp-devel 2.4.5-11.el6_10, ppp-debuginfo 2.4.5-11.el6_10 Red Hat Enterprise Linux HPC Node (v. 6) ppp 2.4.5-11.el6_10 Red Hat Enterprise Linux HPC Node Optional (v. 6) ppp-devel 2.4.5-11.el6_10, ppp-debuginfo 2.4.5-11.el6_10 Red Hat Enterprise Linux Server (v. 6) ppp 2.4.5-11.el6_10fixed: vendor fix RHSA-2020:0631
-
Red Hat Enterprise Linux Server (v. 7) ppp 2.4.5-34.el7_7fixed: vendor fix RHSA-2020:0630
-
Red Hat Enterprise Linux Server Optional (v. 6) ppp-devel 2.4.5-11.el6_10, ppp-debuginfo 2.4.5-11.el6_10fixed: vendor fix RHSA-2020:0631
-
Red Hat Enterprise Linux Server Optional (v. 7) ppp-devel 2.4.5-34.el7_7, ppp-debuginfo 2.4.5-34.el7_7fixed: vendor fix RHSA-2020:0630
show 5 moreshow fewer
-
Red Hat Enterprise Linux Workstation (v. 6) ppp 2.4.5-11.el6_10fixed: vendor fix RHSA-2020:0631
-
Red Hat Enterprise Linux Workstation (v. 7) ppp 2.4.5-34.el7_7fixed: vendor fix RHSA-2020:0630
-
Red Hat Enterprise Linux Workstation Optional (v. 6) ppp-devel 2.4.5-11.el6_10, ppp-debuginfo 2.4.5-11.el6_10fixed: vendor fix RHSA-2020:0631
-
Red Hat Enterprise Linux Workstation Optional (v. 7) ppp-devel 2.4.5-34.el7_7, ppp-debuginfo 2.4.5-34.el7_7fixed: vendor fix RHSA-2020:0630
-
Red Hat Enterprise Linux 5 rp-pppoe Red Hat Enterprise Linux 6 rp-pppoe Red Hat Enterprise Linux 7 rp-pppoenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-20-224-04 updated cvss 9.8
Siemens SCALANCE, RUGGEDCOM
-
Siemens RUGGEDCOM RM1224 <V6.3 Siemens SCALANCE M-800 / S615 <V6.3affected: fixed in V6.3, mitigation
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 11mo ago
Exploit prediction
19.93% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-120 Buffer Copy without Checking Size of Input
References
-
github.com
/paulusmack/ppp/commit/8d7970b8f3db727fe798b65f3377fe6787575426
patch, third-party-advisory
-
debian.org
/security/2020/dsa-4632
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0631
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0634
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0633
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0630
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-03/msg00006.html
vendor-advisory, mailing-list, third-party-advisory
-
usn.ubuntu.com
/4288-1/
vendor-advisory, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/UNJNHWOO4XF73M2W56ILZUY4JQG3JXIR/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/YOFDAIOWSWPG732ASYUZNINMXDHY4APE/
vendor-advisory
-
security.gentoo.org
/glsa/202003-19
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/4288-2/
vendor-advisory, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2020/02/msg00005.html
mailing-list, third-party-advisory
-
kb.cert.org
/vuls/id/782301
third-party-advisory, us-government-resource
-
seclists.org
/fulldisclosure/2020/Mar/6
mailing-list, third-party-advisory
-
packetstormsecurity.com
/files/156662/pppd-2.4.8-Buffer-Overflow.html
third-party-advisory, vdb-entry
-
synology.com
/security/advisory/Synology_SA_20_02
third-party-advisory
-
security.netapp.com
/advisory/ntap-20200313-0004/
third-party-advisory
-
packetstormsecurity.com
/files/156802/pppd-2.4.8-Buffer-Overflow.html
third-party-advisory, vdb-entry
-
kb.netgear.com
/000061806/Security-Advisory-for-Unauthenticated-Remote-Buffer-Overflow-Attack-in-PPPD-on-WAC510-PSV-2020-0136
third-party-advisory
-
cert-portal.siemens.com
/productcert/pdf/ssa-809841.pdf
third-party-advisory
-
us-cert.cisa.gov
/ics/advisories/icsa-20-224-04
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2020-8597
- NVD CVE-2020-8597
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.