Cyber Resilience

CVE-2020-35493

MediumPublic PoC

Published: 04 January 2021

Published
04 January 2021
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score 0.0047 65.0th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2020-35493 is a medium-severity Improper Input Validation (CWE-20) vulnerability in Gnu Binutils. Its CVSS base score is 5.5 (Medium).

Operationally, ranked in the top 35.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to application…

more

availability. This flaw affects binutils versions prior to 2.34.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

gnu
binutils
≤ 2.34
fedoraproject
fedora
32
netapp
cloud backup
all versions
netapp
ontap select deploy administration utility
all versions
netapp
solidfire\, enterprise sds \& hci storage node
all versions
netapp
solidfire \& hci management node
all versions
broadcom
brocade fabric operating system firmware
all versions
netapp
hci compute node firmware
all versions

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-20

Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.

addresses: CWE-20

Security testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.

addresses: CWE-20

Directly implements checks on information inputs to reject invalid data before processing.

addresses: CWE-20

Spam protection mechanisms perform filtering and detection on inbound/outbound messages, directly compensating for missing or weak input validation of unsolicited content.

References