CVE-2020-8597
- State
- Published
- Severity
- 9.8 Critical
- Published
- Feb 3, 2020
- Updated
- Dec 3, 2025
- Reserved
- Feb 3, 2020
Description
eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://github.com/paulusmack/ppp/commit/8d7970b8f3db727fe798b65f3377fe6787575426
- [debian-lts-announce] 20200209 [SECURITY] [DLA 2097-1] ppp security updatemailing-list
- DSA-4632vendor-advisory
- RHSA-2020:0631vendor-advisory
- RHSA-2020:0634vendor-advisory
- RHSA-2020:0633vendor-advisory
- RHSA-2020:0630vendor-advisory
- openSUSE-SU-2020:0286vendor-advisory
- USN-4288-1vendor-advisory
- VU#782301third-party-advisory
- 20200306 Buffer overflow in pppd - CVE-2020-8597mailing-list
- FEDORA-2020-571091c70bvendor-advisory
- http://packetstormsecurity.com/files/156662/pppd-2.4.8-Buffer-Overflow.html
- https://www.synology.com/security/advisory/Synology_SA_20_02
- FEDORA-2020-4304397fe0vendor-advisory
- https://security.netapp.com/advisory/ntap-20200313-0004/
- GLSA-202003-19vendor-advisory
- USN-4288-2vendor-advisory
- http://packetstormsecurity.com/files/156802/pppd-2.4.8-Buffer-Overflow.html
- https://kb.netgear.com/000061806/Security-Advisory-for-Unauthenticated-Remote-Buffer-Overflow-Attack-in-PPPD-on-WAC510-PSV-2020-0136
- https://cert-portal.siemens.com/productcert/pdf/ssa-809841.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-20-224-04
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.