An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - p11-kit: out-of-bounds read in p11_rpc_buffer_get_byte_array function in rpc-message.c (CVE-2020-29362)

  - An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered     in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are     missing before calling realloc or calloc. (CVE-2020-29361)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote NewStart CGSL host, running version MAIN 6.02, has p11-kit packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered     in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are     missing before calling realloc or calloc. (CVE-2020-29361)

  - An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been     discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the     remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may     allow the reading of up to 4 bytes of memory past the heap allocation. (CVE-2020-29362)

  - An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been     discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the     remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate     sufficient length for the buffer to store the deserialized value. (CVE-2020-29363)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1609 advisory.

  - An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered     in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are     missing before calling realloc or calloc. (CVE-2020-29361)

  - An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been     discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the     remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may     allow the reading of up to 4 bytes of memory past the heap allocation. (CVE-2020-29362)

  - An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been     discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the     remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate     sufficient length for the buffer to store the deserialized value. (CVE-2020-29363)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2871-1 advisory.

  - An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been     discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the     remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may     allow the reading of up to 4 bytes of memory past the heap allocation. (CVE-2020-29362)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2405-1 advisory.

  - An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been     discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the     remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may     allow the reading of up to 4 bytes of memory past the heap allocation. (CVE-2020-29362)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1609 advisory.

  - An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered     in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are     missing before calling realloc or calloc. (CVE-2020-29361)

  - An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been     discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the     remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may     allow the reading of up to 4 bytes of memory past the heap allocation. (CVE-2020-29362)

  - An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been     discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the     remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate     sufficient length for the buffer to store the deserialized value. (CVE-2020-29363)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1609 advisory.

    - Rebase to 0.23.22 to fix memory safety issues (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1609 advisory.

  - p11-kit: integer overflow when allocating memory for arrays or attributes and object identifiers     (CVE-2020-29361)

  - p11-kit: out-of-bounds read in p11_rpc_buffer_get_byte_array function in rpc-message.c (CVE-2020-29362)

  - p11-kit: out-of-bounds write in p11_rpc_buffer_get_byte_array_value function in rpc-message.c     (CVE-2020-29363)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1609 advisory.

    The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes     a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files.

    The following packages have been upgraded to a later upstream version: p11-kit (0.23.22). (BZ#1887853)

    Security Fix(es):

    * p11-kit: integer overflow when allocating memory for arrays or attributes and object identifiers     (CVE-2020-29361)

    * p11-kit: out-of-bounds read in p11_rpc_buffer_get_byte_array function in rpc-message.c (CVE-2020-29362)

    * p11-kit: out-of-bounds write in p11_rpc_buffer_get_byte_array_value function in rpc-message.c     (CVE-2020-29363)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of p11-kit installed on the remote host is prior to 0.23.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1601 advisory.

  - An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered     in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are     missing before calling realloc or calloc. (CVE-2020-29361)

  - An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been     discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the     remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may     allow the reading of up to 4 bytes of memory past the heap allocation. (CVE-2020-29362)

  - An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been     discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the     remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate     sufficient length for the buffer to store the deserialized value. (CVE-2020-29363)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the p11-kit packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in p11-kit 0.21.1 through     0.23.21. Multiple integer overflows have been     discovered in the array allocations in the p11-kit     library and the p11-kit list command, where overflow     checks are missing before calling realloc or     calloc.(CVE-2020-29361)

  - An issue was discovered in p11-kit 0.21.1 through     0.23.21. A heap-based buffer over-read has been     discovered in the RPC protocol used by thep11-kit     server/remote commands and the client library. When the     remote entity supplies a byte array through a     serialized PKCS#11 function call, the receiving entity     may allow the reading of up to 4 bytes of memory past     the heap allocation.(CVE-2020-29362)

  - An issue was discovered in p11-kit 0.23.6 through     0.23.21. A heap-based buffer overflow has been     discovered in the RPC protocol used by p11-kit     server/remote commands and the client library. When the     remote entity supplies a serialized byte array in a     CK_ATTRIBUTE, the receiving entity may not allocate     sufficient length for the buffer to store the     deserialized value.(CVE-2020-29363)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the p11-kit package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in p11-kit 0.21.1 through     0.23.21. Multiple integer overflows have been     discovered in the array allocations in the p11-kit     library and the p11-kit list command, where overflow     checks are missing before calling realloc or     calloc.(CVE-2020-29361)

  - An issue was discovered in p11-kit 0.21.1 through     0.23.21. A heap-based buffer over-read has been     discovered in the RPC protocol used by thep11-kit     server/remote commands and the client library. When the     remote entity supplies a byte array through a     serialized PKCS#11 function call, the receiving entity     may allow the reading of up to 4 bytes of memory past     the heap allocation.(CVE-2020-29362)

  - An issue was discovered in p11-kit 0.23.6 through     0.23.21. A heap-based buffer overflow has been     discovered in the RPC protocol used by p11-kit     server/remote commands and the client library. When the     remote entity supplies a serialized byte array in a     CK_ATTRIBUTE, the receiving entity may not allocate     sufficient length for the buffer to store the     deserialized value.(CVE-2020-29363)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the p11-kit packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in p11-kit 0.23.6 through     0.23.21. A heap-based buffer overflow has been     discovered in the RPC protocol used by p11-kit     server/remote commands and the client library. When the     remote entity supplies a serialized byte array in a     CK_ATTRIBUTE, the receiving entity may not allocate     sufficient length for the buffer to store the     deserialized value.(CVE-2020-29363)

  - An issue was discovered in p11-kit 0.21.1 through     0.23.21. A heap-based buffer over-read has been     discovered in the RPC protocol used by thep11-kit     server/remote commands and the client library. When the     remote entity supplies a byte array through a     serialized PKCS#11 function call, the receiving entity     may allow the reading of up to 4 bytes of memory past     the heap allocation.(CVE-2020-29362)

  - An issue was discovered in p11-kit 0.21.1 through     0.23.21. Multiple integer overflows have been     discovered in the array allocations in the p11-kit     library and the p11-kit list command, where overflow     checks are missing before calling realloc or     calloc.(CVE-2020-29361)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the p11-kit packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in p11-kit 0.21.1 through     0.23.21. Multiple integer overflows have been     discovered in the array allocations in the p11-kit     library and the p11-kit list command, where overflow     checks are missing before calling realloc or     calloc.(CVE-2020-29361)

  - An issue was discovered in p11-kit 0.21.1 through     0.23.21. A heap-based buffer over-read has been     discovered in the RPC protocol used by thep11-kit     server/remote commands and the client library. When the     remote entity supplies a byte array through a     serialized PKCS#11 function call, the receiving entity     may allow the reading of up to 4 bytes of memory past     the heap allocation.(CVE-2020-29362)

  - An issue was discovered in p11-kit 0.23.6 through     0.23.21. A heap-based buffer overflow has been     discovered in the RPC protocol used by p11-kit     server/remote commands and the client library. When the     remote entity supplies a serialized byte array in a     CK_ATTRIBUTE, the receiving entity may not allocate     sufficient length for the buffer to store the     deserialized value.(CVE-2020-29363)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4677-1 advisory.

    David Cook discovered that p11-kit incorrectly handled certain memory operations. An attacker could use     this issue to cause p11-kit to crash, resulting in a denial of service, or possibly execute arbitrary     code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several memory safety issues affecting the RPC protocol were fixed in p11-kit, a library providing a way to load and enumerate PKCS#11 modules.

CVE-2020-29361

Multiple integer overflows

CVE-2020-29362

Heap-based buffer over-read

For Debian 9 stretch, these problems have been fixed in version 0.23.3-2+deb9u1.

We recommend that you upgrade your p11-kit packages.

For the detailed security status of p11-kit please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/p11-kit

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

David Cook reported several memory safety issues affecting the RPC protocol in p11-kit, a library providing a way to load and enumerate PKCS#11 modules.

The p11-glue project reports :

CVE-2020-29363: Out-of-bounds write in p11_rpc_buffer_get_byte_array_value functionA heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value.

CVE-2020-29362: Out-of-bounds read in p11_rpc_buffer_get_byte_array functionA heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation.

CVE-2020-29361: Integer overflow when allocating memory for arrays of attributes and object identifiersMultiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc.

New p11-kit packages are available for Slackware 14.2 and -current to fix security issues.

ID	Name	Product	Family	Severity
199625	RHEL 7 : p11-kit (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
187364	NewStart CGSL MAIN 6.02 : p11-kit Multiple Vulnerabilities (NS-SA-2023-0106)	Nessus	NewStart CGSL Local Security Checks	medium
184471	Rocky Linux 8 : p11-kit (RLSA-2021:1609)	Nessus	Rocky Linux Local Security Checks	medium
164371	SUSE SLES12 Security Update : p11-kit (SUSE-SU-2022:2871-1)	Nessus	SuSE Local Security Checks	medium
163263	SUSE SLED15 / SLES15 Security Update : p11-kit (SUSE-SU-2022:2405-1)	Nessus	SuSE Local Security Checks	medium
160793	NewStart CGSL MAIN 6.02 : p11-kit Multiple Vulnerabilities (NS-SA-2022-0066)	Nessus	NewStart CGSL Local Security Checks	medium
157611	AlmaLinux 8 : p11-kit (ALSA-2021:1609)	Nessus	Alma Linux Local Security Checks	medium
149941	Oracle Linux 8 : p11-kit (ELSA-2021-1609)	Nessus	Oracle Linux Local Security Checks	medium
149740	CentOS 8 : p11-kit (CESA-2021:1609)	Nessus	CentOS Local Security Checks	medium
149680	RHEL 8 : p11-kit (RHSA-2021:1609)	Nessus	Red Hat Local Security Checks	medium
147715	Amazon Linux 2 : p11-kit (ALAS-2021-1601)	Nessus	Amazon Linux Local Security Checks	medium
147672	EulerOS Virtualization 2.9.0 : p11-kit (EulerOS-SA-2021-1636)	Nessus	Huawei Local Security Checks	medium
147557	EulerOS Virtualization 3.0.2.6 : p11-kit (EulerOS-SA-2021-1419)	Nessus	Huawei Local Security Checks	medium
147496	EulerOS Virtualization 2.9.1 : p11-kit (EulerOS-SA-2021-1620)	Nessus	Huawei Local Security Checks	medium
147062	EulerOS Virtualization for ARM 64 3.0.6.0 : p11-kit (EulerOS-SA-2021-1568)	Nessus	Huawei Local Security Checks	medium
145743	EulerOS 2.0 SP8 : p11-kit (EulerOS-SA-2021-1161)	Nessus	Huawei Local Security Checks	medium
144747	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : p11-kit vulnerabilities (USN-4677-1)	Nessus	Ubuntu Local Security Checks	medium
144738	Debian DLA-2513-1 : p11-kit security update	Nessus	Debian Local Security Checks	medium
144703	EulerOS 2.0 SP9 : p11-kit (EulerOS-SA-2021-1034)	Nessus	Huawei Local Security Checks	medium
144691	Debian DSA-4822-1 : p11-kit - security update	Nessus	Debian Local Security Checks	medium
144675	EulerOS 2.0 SP9 : p11-kit (EulerOS-SA-2021-1015)	Nessus	Huawei Local Security Checks	medium
144146	FreeBSD : p11-kit -- Multiple vulnerabilities (fdc49972-3ca7-11eb-929d-d4c9ef517024)	Nessus	FreeBSD Local Security Checks	medium
144141	Slackware 14.2 / current : p11-kit (SSA:2020-347-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2020-29362

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium