CVE-2020-12845: cherokee-project cherokee NULL Pointer Dereference
Vulnerability summary
CVE-2020-12845 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in cherokee-project cherokee. EPSS estimates a 3.20% chance of exploitation in the next 30 days, higher than 87.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 27-07-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. A remote unauthenticated attacker can crash the server by sending an HTTP request to protected resources using a malformed Authorization header that is mishandled during a cherokee_buffer_add call within cherokee_validator_parse_basic or cherokee_validator_parse_digest.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
3.20%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
0.00 pp
From 3.20% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundWebserver
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Cherokee-project1 product
- cherokee≥ 0.4.27, ≤ 1.2.104
Mageia1 product
- cherokee< 1.2.103-17.1.mga7
2 vendors · 2 products