CVE-2020-3134

Cisco Email Security Appliance Zip Decompression Engine Denial of Service Vulnerability

State: Published
Severity: 6.5 Medium
Published: Jan 26, 2020
Updated: Nov 15, 2024
Reserved: Dec 12, 2019

Description

A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of zip files. An attacker could exploit this vulnerability by sending an email message with a crafted zip-compressed attachment. A successful exploit could trigger a restart of the content-scanning process, causing a temporary DoS condition. This vulnerability affects Cisco AsyncOS Software for Cisco ESA releases earlier than 13.0.

Scores

CVSS	Score	Vector	Source
3.0	6.5 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	cisco

Weaknesses

CWE-20

Affected Products

Product	Versions
Cisco Email Security Appliance (ESA)Cisco	earlier than 13.0Affected

References

20200122 Cisco Email Security Appliance Zip Decompression Engine Denial of Service Vulnerabilityvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.