CVE-2018-20743 Denial of service in n/a
Remote attackers can cause a denial of service in Mumble servers by flooding messages, leading to daemon hangs or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-20743?
CVE-2018-20743 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 25 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are persisted in the database, which allows remote attackers to cause a denial of service (daemon hang or crash) via a message flood.
Weakness: CWE-20
Which versions are affected by CVE-2018-20743?
It affects 2 products.
Linux distribution packages (6)
mumble SUSE:Package Hub 12 | All versions | 1.2.19-bp150.3.3.1 |
mumble SUSE:Package Hub 15 | All versions | 1.2.19-bp150.3.3.1 |
mumble SUSE:Package Hub 15 SP1 | All versions | 1.2.19-bp151.6.3.1 |
mumble SUSE:Package Hub 15 SP1 | All versions | 1.2.19-bp151.6.6.1 |
mumble openSUSE:Leap 15.0 | All versions | 1.2.19-bp150.3.3.1 |
mumble openSUSE:Leap 15.1 | All versions | 1.2.19-bp150.3.3.1 |
Products include Debian Debian Linux, Mumble Mumble.
How do I fix CVE-2018-20743?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-20743 being exploited?
There is no known exploitation of CVE-2018-20743 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-20743, DLA-1661-1, DSA-4402-1, GHSA-m3vr-wjwg-vh63, MGASA-2019-0145, UBUNTU-CVE-2018-20743 and 3 more.