A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the client-tags CGI handler when client tags are configured and memory allocations fail can lead to a system crash.

The remote host is affected by the vulnerability described in GLSA-202107-16 (Privoxy: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in privoxy. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker could cause a possible Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4886-1 advisory.

    It was discovered that Privoxy incorrectly handled CGI requests. An attacker could possibly use this issue     to cause a denial of service or obtain sensitive information. (CVE-2020-35502, CVE-2021-20209,     CVE-2021-20210, CVE-2021-20213, CVE-2021-20215, CVE-2021-20216, CVE-2021-20217, CVE-2021-20272,     CVE-2021-20273, CVE-2021-20275)

    It was discovered that Privoxy incorrectly handled certain regular expressions. An attacker could possibly     use this issue to cause a denial of service or obtain sensitive information. (CVE-2021-20212,     CVE-2021-20276)

    It was discovered that Privoxy incorrectly handled client tags. An attacker could possibly use this issue     to cause Privoxy to consume resources, resulting in a denial of service. This issue only affected Ubuntu     18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2021-20211)

    It was discovered that Privoxy incorrectly handled client tags. An attacker could possibly use this issue     to cause Privoxy to consume resources, resulting in a denial of service. This issue only affected Ubuntu     20.04 LTS and Ubuntu 20.10. (CVE-2021-20214)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
157017	GLSA-202107-16 : Privoxy: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
147971	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Privoxy vulnerabilities (USN-4886-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2021-20214

high

Tenable Plugins

high

high