CVE Vulnerabilities

CVE-2017-14149

NULL Pointer Dereference

Published: Sep 05, 2017 | Modified: Sep 05, 2017
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu

GoAhead 3.4.0 through 3.6.5 has a NULL Pointer Dereference in the websDecodeUrl function in http.c, leading to a crash for a POST / HTTP/1.1 request.

Weakness

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Affected Software

Name Vendor Start Version End Version
Goahead Embedthis 3.4.0 (including) 3.4.0 (including)
Goahead Embedthis 3.4.1 (including) 3.4.1 (including)
Goahead Embedthis 3.4.2 (including) 3.4.2 (including)
Goahead Embedthis 3.4.3 (including) 3.4.3 (including)
Goahead Embedthis 3.4.4 (including) 3.4.4 (including)
Goahead Embedthis 3.4.5 (including) 3.4.5 (including)
Goahead Embedthis 3.4.6 (including) 3.4.6 (including)
Goahead Embedthis 3.4.7 (including) 3.4.7 (including)
Goahead Embedthis 3.4.8 (including) 3.4.8 (including)
Goahead Embedthis 3.4.9 (including) 3.4.9 (including)
Goahead Embedthis 3.4.10 (including) 3.4.10 (including)
Goahead Embedthis 3.4.11 (including) 3.4.11 (including)
Goahead Embedthis 3.4.12 (including) 3.4.12 (including)
Goahead Embedthis 3.5.0 (including) 3.5.0 (including)
Goahead Embedthis 3.6.0 (including) 3.6.0 (including)
Goahead Embedthis 3.6.1 (including) 3.6.1 (including)
Goahead Embedthis 3.6.2 (including) 3.6.2 (including)
Goahead Embedthis 3.6.3 (including) 3.6.3 (including)
Goahead Embedthis 3.6.4 (including) 3.6.4 (including)
Goahead Embedthis 3.6.5 (including) 3.6.5 (including)

Potential Mitigations

References