CVE-2020-6095
Fixed in a distro release EPSS 3%CVSS 7.5
An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cause a null pointer deference resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.
Products: gstreamer_project gst-rtsp-server, opensuse backports_sle, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | gst-rtsp-server1.0 | 1.16.2-3 |
| Debian 13 | gst-rtsp-server1.0 | 1.16.2-3 |
| Debian 14 | gst-rtsp-server1.0 | 1.16.2-3 |
| SUSE Package Hub 15 SP1 | gstreamer-rtsp-server | 1.12.5-bp151.4.3.1 |
| Ubuntu 16.04 LTS | gst-rtsp-server1.0 | no fix |
| Ubuntu 18.04 LTS | gst-rtsp-server1.0 | no fix |
| openSUSE Leap 15.1 | gstreamer-rtsp-server | 1.12.5-bp151.4.3.1 |
| openSUSE Tumbleweed | gstreamer-rtsp-server | 1.18.5-1.1 |