{"id":"CVE-2020-5208","details":"It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19.","aliases":["GHSA-g659-9qxw-p7cp"],"modified":"2026-07-09T01:29:59.574436Z","published":"2020-02-05T14:15:11.420Z","related":["SUSE-SU-2020:0405-1","SUSE-SU-2020:0617-1","SUSE-SU-2020:0630-1","SUSE-SU-2020:14313-1","openSUSE-SU-2020:0247-1","openSUSE-SU-2024:10864-1"],"database_specific":{"unresolved_ranges":[{"vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING"},{"cpes":["cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"30"},{"last_affected":"30"},{"introduced":"31"},{"last_affected":"31"}],"source":"CPE_STRING","vendor_product":"fedoraproject:fedora"},{"cpes":["cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"15.1"},{"last_affected":"15.1"}],"source":"CPE_STRING","vendor_product":"opensuse:leap"}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K2BPW66KDP4H36AGZXLED57A3O2Y6EQW/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RYYEKUAUTCWICM77HOEGZDVVEUJLP4BP/"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00031.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/02/msg00006.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00029.html"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202101-03"},{"type":"FIX","url":"https://github.com/ipmitool/ipmitool/commit/e824c23316ae50beb7f7488f2055ac65e8b341f2"},{"type":"FIX","url":"https://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ipmitool/ipmitool","events":[{"introduced":"b5ce925744851b58193ad3ee18957ce88f6efc26"},{"last_affected":"b5ce925744851b58193ad3ee18957ce88f6efc26"},{"fixed":"e824c23316ae50beb7f7488f2055ac65e8b341f2"}],"database_specific":{"cpe":"cpe:2.3:a:ipmitool_project:ipmitool:1.8.18:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.8.18"},{"last_affected":"1.8.18"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["1.8.18","IPMITOOL_1_8_18"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5208.json","vanir_signatures_modified":"2026-07-09T01:29:59Z","vanir_signatures":[{"source":"https://github.com/ipmitool/ipmitool/commit/e824c23316ae50beb7f7488f2055ac65e8b341f2","target":{"file":"lib/ipmi_fru.c","function":"read_fru_area_section"},"deprecated":false,"digest":{"function_hash":"192886428758089050892367244975157064793","length":1701},"id":"CVE-2020-5208-361d9920","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"134019777437021869972891340940394982863","length":2145},"id":"CVE-2020-5208-95bc5e1f","signature_type":"Function","signature_version":"v1","source":"https://github.com/ipmitool/ipmitool/commit/e824c23316ae50beb7f7488f2055ac65e8b341f2","target":{"file":"lib/ipmi_fru.c","function":"read_fru_area"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/ipmitool/ipmitool/commit/e824c23316ae50beb7f7488f2055ac65e8b341f2","target":{"file":"lib/ipmi_fru.c"},"deprecated":false,"digest":{"line_hashes":["57076867987319810854233613857946262088","236455093077017610747203830435885499403","50302983535718889553902051495726656844","127240053834604641190049528171308280594","171490552444983707541313881547760775382","159468252494031490108302431114206618012","90869396626081300417576987662951969291","158296759207413761725236324976059046106","333449966720909451653097200969841430185","243363549478903765859419170374154158847","168649472567545880875518271251405817713","44295945655746834570285452179811915295","99042831342086855809199899281077268132","69275239738053955360996024045230482674","182594728877648145376787303490332092721","13648507444097223767168718815638888394","315387753671988408139076220211215164454","82436235867193713512548748195290102799","204427108457237212630070253610306739008","25471238540442471233640752005268856307","83292191667530993419136007046260669268","265184154697531959962865615124016063860","265745931496434714655901594370802605299","74275860038477994846903371863830996366","287124388342538269033154908689897118951","127240053834604641190049528171308280594","171490552444983707541313881547760775382","159468252494031490108302431114206618012","90869396626081300417576987662951969291","158296759207413761725236324976059046106","333449966720909451653097200969841430185","243363549478903765859419170374154158847","168649472567545880875518271251405817713","44295945655746834570285452179811915295","126802022020050959000339982198636948947","227796436680837261900849338051402674176","193245646791272897850468398052174396305","92560596906955904854177872398064960912","13648507444097223767168718815638888394","167307511504313380807613353316085981725","168357358145000016114140709761680186784","336451364272383594355124115874525625255","33785226047952495029146364540215980849","192128900186167947288651281698769174820"],"threshold":0.9},"id":"CVE-2020-5208-facc6859"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}