NULL pointer dereference in Gstreamer Project Gst-Rtsp-Server
CVE-2020-6095
An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cause a null pointer deference resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.029 (86.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 86.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.029 · newest: 0.029 · change: 0.000
Affected products
- Gstreamer Project Gst-Rtsp-Server — versions 1.14.5
- openSUSE Backports Sle — versions 15.0
- openSUSE Leap — versions 15.1
- Gstreamer — versions GStreamer gst-rtsp-server 1.14.5
Weakness classification (CWE)
References
- lists.opensuse.org/opensuse-security-announce/2020-04/msg00029.html (vendor-advisory, Mailing List, Third Party Advisory)
- security.gentoo.org/glsa/202009-05 (vendor-advisory, Third Party Advisory)
- www.talosintelligence.com/vulnerability_reports/TALOS-2020-1018 (Exploit, Third Party Advisory)
- gitlab.freedesktop.org/gstreamer/gst-rtsp-server/-/commit/44ccca3086dd81081d72c… (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-6095?
- CVE-2020-6095 is a high-severity vulnerability in Gstreamer Project Gst-Rtsp-Server, classified under CWE-690. CVSS score: 7.5/10. Published 2020-03-27.
- How severe is CVE-2020-6095?
- High severity. CVSS v3 base score is 7.5 out of 10.