VDB

CVE-2020-10701

CVE-2020-10701 PUBLISHED CVSS 6.5 MEDIUM

A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to adjust the time that libvirt waits for the QEMU guest agent to respond to agent commands. Depending on the timeout value that is set, this flaw can make guest agent commands fail because the agent cannot respond in time. Unprivileged users with a read-only connection could abuse this flaw to set the response timeout for all guest agent messages to zero, potentially leading to a denial of service. This flaw affects libvirt versions before 6.2.0.

EPSS 0.24% · 47.6th percentile

Risk Scores

CVSS v3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.24%
47.6th percentile

Affected Products

VendorProductVersions
n/alibvirtlibvirt 6.2.0
redhatlibvirt0

Timeline

  • May 27, 2021 CVE Published
  • May 28, 2021 EPSS Score
  • Jul 30, 2021 EPSS Score
  • Sep 29, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Jan 30, 2022 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • Jun 1, 2022 EPSS Score
  • Aug 2, 2022 EPSS Score
  • Dec 2, 2022 EPSS Score
  • Feb 1, 2023 EPSS Score
Open in Interactive Console →
$ Console Community · 100/wk Open console ›