CVE-2018-20799 Security feature bypass in n/a

High 7.5 Published 1 Mar 2019 Updated 5 Aug 2024

Inconsistent IP blocking for failed HTTPS versus SSH authentication allows attackers to bypass intended access restrictions in pfSense.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-20799?

CVE-2018-20799 is a high-severity vulnerability in n/a, published on 1 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In pfSense 2.4.4_1, blocking of source IP addresses on the basis of failed HTTPS authentication is inconsistent with blocking of source IP addresses on the basis of failed SSH authentication (the behavior does not match the sshguard documentation), which might make it easier for attackers to bypass intended access restrictions.

Which versions are affected by CVE-2018-20799?

It affects 1 product.

Products include Netgate Pfsense.

How do I fix CVE-2018-20799?

No fix has been published for CVE-2018-20799 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-20799 being exploited?

There is no known exploitation of CVE-2018-20799 in the wild and no public exploit code.

Sources

Also known as GHSA-556r-ph87-2m55.