CVE-2019-13120
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Amazon FreeRTOS up to and including v1.4.8 lacks length checking in prvProcessReceivedPublish, resulting in untargetable leakage of arbitrary memory contents on a device to an attacker. If an attacker has the authorization to send a malformed MQTT publish packet to an Amazon IoT Thing, which interacts with an associated vulnerable MQTT message in the application, specific circumstances could trigger this vulnerability.
Amazon FreeRTOS hasta la versión v1.4.8, incluido, carece de verificación de longitud en prvProcessReceivedPublish, dando como resultado una fuga no direccionable de contenido de memoria arbitraria en un dispositivo a un atacante. Si un atacante tiene la autorización para enviar un paquete de publicación MQTT con formato incorrecto a una cosa de Amazon IoT, que interactúa con un mensaje MQTT vulnerable asociado en la aplicación, circunstancias específicas podrían desencadenar esta vulnerabilidad.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-06-30 CVE Reserved
- 2019-10-07 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-125: Out-of-bounds Read
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://aws.amazon.com/cn/freertos/security-updates | 2022-11-02 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Amazon Search vendor "Amazon" | Amazon Web Services Freertos Search vendor "Amazon" for product "Amazon Web Services Freertos" | <= 1.4.8 Search vendor "Amazon" for product "Amazon Web Services Freertos" and version " <= 1.4.8" | - |
Affected
|