CVE-2019-20919 Null dereference in n/a

Medium 4.7 Published 17 Sep 2020 Updated 5 Aug 2024

A NULL pointer dereference in the Perl DBI module allows attackers to cause a denial of service via crafted input.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2019-20919?

CVE-2019-20919 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 17 Sep 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference.

Weakness: CWE-476

Which versions are affected by CVE-2019-20919?

It affects 5 products.

Linux distribution packages (8)

`perl-DBI` SUSE:Linux Enterprise High Performance Computing 15-ESPOS	All versions	`1.639-3.11.1`
`perl-DBI` SUSE:Linux Enterprise High Performance Computing 15-LTSS	All versions	`1.639-3.11.1`
`perl-DBI` SUSE:Linux Enterprise Module for Basesystem 15 SP1	All versions	`1.639-3.11.1`
`perl-DBI` SUSE:Linux Enterprise Module for Basesystem 15 SP2	All versions	`1.642-3.6.1`
`perl-DBI` SUSE:Linux Enterprise Server 15-LTSS	All versions	`1.639-3.11.1`
`perl-DBI` SUSE:Linux Enterprise Server for SAP Applications 15	All versions	`1.639-3.11.1`
`perl-DBI` openSUSE:Leap 15.1	All versions	`1.639-lp151.3.13.1`
`perl-DBI` openSUSE:Leap 15.2	All versions	`1.642-lp152.2.6.1`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Opensuse Leap, Perl Dbi.

How do I fix CVE-2019-20919?

Upgrade to a fixed version.

Is CVE-2019-20919 being exploited?

There is no known exploitation of CVE-2019-20919 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2019-20919, GHSA-f5xq-vjwc-pqqj, SUSE-SU-2020:2827-1, SUSE-SU-2020:2828-1, UBUNTU-CVE-2019-20919, USN-4534-1 and 2 more.