A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could     connect to the nbdkit service and cause it to perform a large amount of work in initializing backend     plugins, by simply opening a connection to the service. This vulnerability could cause resource     consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.
    (CVE-2019-14850)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1167 advisory.

    - Fix for CVE-2019-14850 denial of service due to premature opening       of back-end connection       resolves: rhbz#1757261

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

* nbdkit: denial of service due to premature opening of back-end connection

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1167 advisory.

  - A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could     connect to the nbdkit service and cause it to perform a large amount of work in initializing backend     plugins, by simply opening a connection to the service. This vulnerability could cause resource     consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.
    (CVE-2019-14850)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1167 advisory.

    Network Block Device (NBD) is a protocol for accessing hard disks and other disk-like devices over the     network. The nbdkit toolkit utilizes NBD to create servers with minimal dependencies. The package contains     plug-in support for the C and Python programming languages.

    Security Fix(es):

    * nbdkit: denial of service due to premature opening of back-end connection (CVE-2019-14850)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
222422	Linux Distros Unpatched Vulnerability : CVE-2019-14850	Nessus	Misc.	low
180629	Oracle Linux 7 : nbdkit (ELSA-2020-1167)	Nessus	Oracle Linux Local Security Checks	low
135824	Scientific Linux Security Update : nbdkit on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	low
135348	CentOS 7 : nbdkit (RHSA-2020:1167)	Nessus	CentOS Local Security Checks	low
135074	RHEL 7 : nbdkit (RHSA-2020:1167)	Nessus	Red Hat Local Security Checks	low

Detections

Analytics

CVE-2019-14850

low

Tenable Plugins

low

low

low

low

low