CVE-2020-10188
CVE-2020-10188
This page contains facts from public vulnerability sources. Check the original advisory before updating.
utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions.
CVSS 9.8 · Critical · EPSS 74.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
inetutils Debian:12
- Affected ranges
- ECOSYSTEM: < 2:1.9.4-12
Update to 2:1.9.4-12
inetutils Debian:13
- Affected ranges
- ECOSYSTEM: < 2:1.9.4-12
Update to 2:1.9.4-12
inetutils Debian:14
- Affected ranges
- ECOSYSTEM: < 2:1.9.4-12
Update to 2:1.9.4-12
netkit-telnet-ssl Debian:12
- Affected ranges
- ECOSYSTEM: < 0.17.17+0.1-2woody3
Update to 0.17.17+0.1-2woody3
netkit-telnet-ssl Debian:13
- Affected ranges
- ECOSYSTEM: < 0.17.17+0.1-2woody3
Update to 0.17.17+0.1-2woody3
netkit-telnet-ssl Debian:14
- Affected ranges
- ECOSYSTEM: < 0.17.17+0.1-2woody3
Update to 0.17.17+0.1-2woody3
inetutils Ubuntu:Pro:14.04:LTS
- Versions
- 2:1.9.1.306-0a482-1
- 2:1.9.1.363-bbc1-1
- 2:1.9.2-1
- 2:1.9.2-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: < 2:1.9.2-1ubuntu0.1~esm2
Update to 2:1.9.2-1ubuntu0.1~esm2
inetutils Ubuntu:Pro:16.04:LTS
- Versions
- 2:1.9.4-1
- 2:1.9.4-1build1
- Affected ranges
- ECOSYSTEM: < 2:1.9.4-1ubuntu0.1~esm1
Update to 2:1.9.4-1ubuntu0.1~esm1
netkit-telnet-ssl Ubuntu:16.04:LTS
- Versions
- 0.17.40+0.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
inetutils Ubuntu:18.04:LTS
- Versions
- 2:1.9.4-2build1
- 2:1.9.4-3
- Affected ranges
- ECOSYSTEM: < 2:1.9.4-3ubuntu0.1
Update to 2:1.9.4-3ubuntu0.1
netkit-telnet-ssl Ubuntu:18.04:LTS
- Versions
- 0.17.41+0.2-3
- 0.17.41+0.2-3build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
inetutils Ubuntu:20.04:LTS
- Versions
- 2:1.9.4-10build1
- 2:1.9.4-11
- Affected ranges
- ECOSYSTEM: < 2:1.9.4-11ubuntu0.1
Update to 2:1.9.4-11ubuntu0.1
netkit-telnet-ssl Ubuntu:20.04:LTS
- Versions
- 0.17.41+0.2-3.2
- 0.17.41+0.2-3.2build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netkit-telnet-ssl Ubuntu:22.04:LTS
- Versions
- 0.17.41+0.2-3.3build1
- 0.17.41+0.2-3.3build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netkit-telnet-ssl Ubuntu:24.04:LTS
- Versions
- 0.17.41+really0.17-4
- 0.17.41+really0.17-4build1
- 0.17.41+really0.17-4build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netkit-telnet-ssl Ubuntu:25.10
- Versions
- 0.17.41+really0.17-5
- 0.17.41+really0.17-6
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netkit-telnet-ssl Ubuntu:26.10
- Versions
- 0.17.41+really0.17-7
- 0.17.41+really0.17-8
- 0.17.41+really0.17-8build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netkit-telnet-ssl Ubuntu:26.04:LTS
- Versions
- 0.17.41+really0.17-6
- 0.17.41+really0.17-7
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLU6FL24BSQQEB2SJC26NLJ2MANQDA7M/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7FMTRRQTYKWZD2GMXX3GLZV46OLPCLVK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3VJ6V2Z3JRNJOBVHSOPMAC76PSSKG6A/
- https://lists.debian.org/debian-lts-announce/2020/05/msg00012.html
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-telnetd-EFJrEzPx
- https://lists.debian.org/debian-lts-announce/2020/08/msg00038.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://appgateresearch.blogspot.com/2020/02/bravestarr-fedora-31-netkit-telnetd_28.html
- https://github.com/krb5/krb5-appl/blob/d00cd671dfe945791b33d4f1f6a5c57ae1667ef8/telnet/telnetd/utility.c#L205-L216
- https://www.arista.com/en/support/advisories-notices/security-advisories/10702-security-advisory-48
- http://www.openwall.com/lists/oss-security/2026/01/20/8
- https://nvd.nist.gov/vuln/detail/CVE-2020-10188