libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:0768 advisory.

  - libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.
    (CVE-2020-28241)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:0768 advisory.

  - libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.
    (CVE-2020-28241)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-0768 advisory.

  - libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.
    (CVE-2020-28241)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0768 advisory.

  - libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c (CVE-2020-28241)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:0768 advisory.

  - libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.
    (CVE-2020-28241)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0751 advisory.

  - libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c (CVE-2020-28241)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0750 advisory.

  - libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c (CVE-2020-28241)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5751-1 advisory.

  - libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.
    (CVE-2020-28241)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the libmaxminddb package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - libmaxminddb before 1.4.3 has a heap-based buffer     over-read in dump_entry_data_list in     maxminddb.c.(CVE-2020-28241)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New version 1.4.3. Security fix for CVE-2020-28241.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202011-15 (libmaxminddb: Denial of service)

    libmaxminddb used uninitialised memory when reading from a corrupt       database file.
  Impact :

    A remote attacker could entice a user to use a specially crafted       database with libmaxminddb, possibly resulting in a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 20.04 LTS / 20.10 host has packages installed that are affected by a vulnerability as referenced in the USN-4631-1 advisory.

  - libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.
    (CVE-2020-28241)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A heap-based buffer over-read has been found in libmaxminddb, an IP geolocation database library. This could be exploited when the mmdblookup tool is used to open a specially crafted database file.

For Debian 9 stretch, this problem has been fixed in version 1.2.0-1+deb9u1.

We recommend that you upgrade your libmaxminddb packages.

For the detailed security status of libmaxminddb please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libmaxminddb

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
191912	Rocky Linux 8 : libmaxminddb (RLSA-2024:0768)	Nessus	Rocky Linux Local Security Checks	medium
190414	AlmaLinux 8 : libmaxminddb (ALSA-2024:0768)	Nessus	Alma Linux Local Security Checks	medium
190406	Oracle Linux 8 : libmaxminddb (ELSA-2024-0768)	Nessus	Oracle Linux Local Security Checks	medium
190399	RHEL 8 : libmaxminddb (RHSA-2024:0768)	Nessus	Red Hat Local Security Checks	medium
190396	CentOS 8 : libmaxminddb (CESA-2024:0768)	Nessus	CentOS Local Security Checks	medium
190333	RHEL 8 : libmaxminddb (RHSA-2024:0751)	Nessus	Red Hat Local Security Checks	medium
190330	RHEL 8 : libmaxminddb (RHSA-2024:0750)	Nessus	Red Hat Local Security Checks	medium
183696	Ubuntu 16.04 ESM : libmaxminddb vulnerability (USN-5751-1)	Nessus	Ubuntu Local Security Checks	medium
145719	EulerOS 2.0 SP8 : libmaxminddb (EulerOS-SA-2021-1152)	Nessus	Huawei Local Security Checks	medium
144617	Fedora 33 : libmaxminddb (2020-8a8f8b244f)	Nessus	Fedora Local Security Checks	medium
144615	Fedora 32 : libmaxminddb (2020-1fb1785fa1)	Nessus	Fedora Local Security Checks	medium
142923	GLSA-202011-15 : libmaxminddb: Denial of service	Nessus	Gentoo Local Security Checks	medium
142866	Ubuntu 20.04 LTS : libmaxminddb vulnerability (USN-4631-1)	Nessus	Ubuntu Local Security Checks	medium
142827	Debian DLA-2445-1 : libmaxminddb security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-28241

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium