Memory Leak in Privoxy show-status CGI Handler (CVE-2021-20210)
Summary
CVE-2021-20210: A flaw was found in Privoxy in versions before 3.0.29. Affects privoxy versions < 3.0.29-r0. Fixed in 3.0.29-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Privoxy is an open-source web proxy with advanced filtering capabilities. It is designed to protect privacy, modify web page data, and block unwanted content. Privoxy is commonly used to enhance web browsing security and privacy. However, a vulnerability has been discovered in Privoxy versions before 3.0.29 that can lead to a system crash due to a memory leak in the show-status CGI handler when no filter files are configured.
Vulnerability Detail
The vulnerability (CVE-2021-20210) in Privoxy arises from a memory leak issue in the show-status CGI handler. When no filter files are configured, the show-status CGI handler fails to release allocated memory, resulting in a continuous memory leak. This can eventually exhaust system resources and lead to a system crash. An attacker can exploit this vulnerability by sending specially crafted requests to the affected Privoxy instance, causing a denial-of-service condition. The impact of this vulnerability is limited to a system crash and does not allow for remote code execution or unauthorized access.
How To Fix
Minimum fixed version
3.0.29-r0
This is the first release that contains the fix.
sudo apk add --upgrade privoxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to Privoxy version 3.0.29 or later.
Conclusion
The memory leak vulnerability in Privoxy's show-status CGI handler can lead to a system crash when no filter files are configured. It is crucial to upgrade to Privoxy version 3.0.29 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for privoxy →
FAQ
Privoxy is an open-source web proxy that provides advanced filtering capabilities to enhance web browsing security and privacy.
The vulnerability can lead to a system crash due to a memory leak in the show-status CGI handler when no filter files are configured. However, it does not allow for remote code execution or unauthorized access.
To fix this vulnerability, upgrade to Privoxy version 3.0.29 or later.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading Privoxy.
Users can obtain the latest version of Privoxy from the official website or through package managers specific to their operating system.
Related vulnerabilities
Recent vulnerabilities recorded for privoxy.
