CVE-2019-14850
Published: 18 March 2021
Summary
CVE-2019-14850 is a low-severity Network Amplification (CWE-406) vulnerability in Nbdkit Project Nbdkit. Its CVSS base score is 3.7 (Low).
Operationally, ranked in the top 46.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-5973
Vulnerability details
A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection…
more
to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Limits attacker success in sustaining network amplification DoS against the primary by providing a ready alternate processing capability.
Provides continuity when primary telecom is disrupted by insufficient control of network message volume or amplification.
Network-volume amplification against one channel can be bypassed via the pre-established alternate path.
Implements network message volume controls to block amplification DoS vectors.