CVE-2019-14850 Denial of service in nbdkit
An attacker can cause resource exhaustion and service degradation in nbdkit by opening connections that trigger heavy backend plugin initialization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-14850?
CVE-2019-14850 is a low-severity denial of service vulnerability in Redhat Enterprise Linux, published on 18 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.
Weakness: CWE-406
Which versions are affected by CVE-2019-14850?
It affects 4 products.
Linux distribution packages (8)
nbdkit Red Hat:enterprise_linux:7::server | All versions | 0:1.8.0-3.el7 |
nbdkit-basic-plugins Red Hat:enterprise_linux:7::server | All versions | 0:1.8.0-3.el7 |
nbdkit-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:1.8.0-3.el7 |
nbdkit-devel Red Hat:enterprise_linux:7::server | All versions | 0:1.8.0-3.el7 |
nbdkit-example-plugins Red Hat:enterprise_linux:7::server | All versions | 0:1.8.0-3.el7 |
nbdkit-plugin-python-common Red Hat:enterprise_linux:7::server | All versions | 0:1.8.0-3.el7 |
nbdkit-plugin-python2 Red Hat:enterprise_linux:7::server | All versions | 0:1.8.0-3.el7 |
nbdkit-plugin-vddk Red Hat:enterprise_linux:7::server | All versions | 0:1.8.0-3.el7 |
Products include Nbdkit Project Nbdkit, Redhat Enterprise Linux, Redhat Enterprise Linux Server, Redhat Virtualization.
How do I fix CVE-2019-14850?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-14850 being exploited?
There is no known exploitation of CVE-2019-14850 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
Sources
Also known as DEBIAN-CVE-2019-14850, GHSA-j552-f62v-mc74, RHSA-2020:1167, UBUNTU-CVE-2019-14850.