CVE-2018-20840 Denial of service in n/a
A malicious user can trigger an unhandled exception in the Google API C++ Client during sign-in, causing a denial of service for third-party services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-20840?
CVE-2018-20840 is a high-severity denial of service vulnerability in n/a, published on 30 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unhandled exception vulnerability exists during Google Sign-In with Google API C++ Client before 2019-04-10. It potentially causes an outage of third-party services that were not designed to recover from exceptions. On the client, ID token handling can cause an unhandled exception because of misinterpretation of an integer as a string, resulting in denial-of-service and then other users can no longer login/sign-in to the affected third-party service. Once this third-party service uses Google Sign-In with google-api-cpp-client, a malicious user can trigger this client/auth/oauth2_authorization.cc vulnerability by requesting the client to receive the ID token from a Google authentication server.
Weakness: CWE-754
Which versions are affected by CVE-2018-20840?
It affects 1 product.
Products include Google Api C\+\+ Client.
How do I fix CVE-2018-20840?
No fix has been published for CVE-2018-20840 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-20840 being exploited?
There is no known exploitation of CVE-2018-20840 in the wild and no public exploit code.
Sources
Also known as GHSA-jw9r-r4mj-mpxx.