What’s Vulnerable › Vulnerabilities

CVE-2019-20917

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-09-11 · updated 2026-06-17
• Weakness: CWE-476

Description

An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.

Affected products

• Debian Linux: 9.0, 10.0
• Inspircd: from 2.0 before 2.0.28; from 3.0 before 3.3.0 — fixed in 2.0.28, 3.3.0

How to fix

Upgrade to a fixed version: Inspircd 2.0.28, 3.3.0. Check the vendor advisory for mitigations.

References

• https://docs.inspircd.org/security/2019-02/
• https://github.com/inspircd/inspircd/commit/2cc35d8625b7ea5cbd1d1ebb116aff86c5280162
• https://github.com/inspircd/inspircd/commit/8745660fcdac7c1b80c94cfc0ff60928cd4dd4b7
• https://lists.debian.org/debian-lts-announce/2020/09/msg00015.html
• https://www.debian.org/security/2020/dsa-4764
• https://docs.inspircd.org/security/2019-02/
• https://github.com/inspircd/inspircd/commit/2cc35d8625b7ea5cbd1d1ebb116aff86c5280162
• https://github.com/inspircd/inspircd/commit/8745660fcdac7c1b80c94cfc0ff60928cd4dd4b7
• https://lists.debian.org/debian-lts-announce/2020/09/msg00015.html
• https://www.debian.org/security/2020/dsa-4764

Get alerted when CVE-2019-20917 or the next vulnerability affects your stack