CVE-2020-6095

An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cause a null pointer deference resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.

References

Affected packages

Git / github.com/gstreamer/gst-rtsp-server

Affected ranges

Type

GIT

Repo

https://github.com/gstreamer/gst-rtsp-server

Events

Introduced

Last affected

1ad54eecfdf634ab6eb672c81df1602d004d75b8

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.14.5"
        }
    ]
}

Type
Repo: https://gitlab.freedesktop.org/gstreamer/gst-rtsp-server
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

44ccca3086dd81081d72ca0b21d0ecdde962fb1a

Affected versions

1.*

1.10.0

1.11.0

1.11.1

1.11.2

1.11.90

1.11.91

1.12.0

1.13.1

1.13.90

1.13.91

1.14.0

1.14.1

1.14.2

1.14.3

1.14.4

1.14.5

1.3.1

1.3.2

1.3.3

1.3.90

1.3.91

1.4.0

1.5.1

1.5.2

1.5.90

1.5.91

1.6.0

1.7.1

1.7.2

1.7.90

1.7.91

1.8.0

1.9.1

1.9.2

1.9.90

Other

CHANGELOG_START

RELEASE-0.*

RELEASE-0.10.1

RELEASE-0.10.2

RELEASE-0.10.3

RELEASE-0.10.4

RELEASE-0.10.5

RELEASE-0.10.6

RELEASE-0.10.7

RELEASE-0.10.8

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.0-sp1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.1"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-6095.json"