CVE-2019-20917
An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains...
An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
- Record
CVE-2019-20917- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:L/Au:S/C:N/I:N/A:C - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
- Record
CVE-2019-20917- Updated
- 2026-11-02
EUVDEUVD-2019-11450 No score
An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
- Record
EUVD-2019-11450- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8h73-696h-wwm7
An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains...
An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
- Record
GHSA-8h73-696h-wwm7- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
- Record
CVE-2019-20917- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-20917
An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
- Record
DEBIAN-CVE-2019-20917- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-20917
An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
- Record
UBUNTU-CVE-2019-20917- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-7405-1 No score
inspircd vulnerabilities
It was discovered that InspIRCd did not correctly handle certificate fingerprints, which could lead to spoofing. A remote attacker could possibly use this issue to bypass authentication. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-7142)
It was discovered that InspIRCd did not correctly handle certain memory operations, which could lead to a NULL pointer dereference. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-20917)
It was discovered that InspIRCd did not correctly handle certain memory operations, which could lead to a use-after-free. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2020-25269)
- Record
USN-7405-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
inspircdDebian:12 |
before 3.3.0-1 | 3.3.0-1 |
inspircdDebian:13 |
before 3.3.0-1 | 3.3.0-1 |
inspircdDebian:9 From an advisory covering 2 CVEs |
before 2.0.23-2+deb9u1, plus listed versions 2.0.23-2 |
2.0.23-2+deb9u1 |
inspircdDebian:10 From an advisory covering 2 CVEs |
before 2.0.27-1+deb10u1, plus listed versions 2.0.27-1 |
2.0.27-1+deb10u1 |
inspircdUbuntu:Pro:16.04:LTS |
before 2.0.20-5ubuntu0.1~esm1, plus listed versions 2.0.20-32.0.20-42.0.20-52.0.20-5build12.0.20-5build2 |
2.0.20-5ubuntu0.1~esm1 |
inspircdUbuntu:Pro:18.04:LTS |
before 2.0.24-1ubuntu1+esm1, plus listed versions 2.0.24-1ubuntu1 |
2.0.24-1ubuntu1+esm1 |
inspircdUbuntu:Pro:16.04:LTS From an advisory covering 3 CVEs |
before 2.0.20-5ubuntu0.1~esm1, plus listed versions 2.0.20-32.0.20-42.0.20-52.0.20-5build12.0.20-5build2 |
2.0.20-5ubuntu0.1~esm1 |
inspircdUbuntu:Pro:18.04:LTS From an advisory covering 3 CVEs |
before 2.0.24-1ubuntu1+esm1, plus listed versions 2.0.24-1ubuntu1 |
2.0.24-1ubuntu1+esm1 |
inspircdUbuntu:Pro:20.04:LTS From an advisory covering 3 CVEs |
before 3.4.0-2ubuntu1+esm1, plus listed versions 2.0.27-1ubuntu23.4.0-2ubuntu1 |
3.4.0-2ubuntu1+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-20917 is a medium vulnerability (CVSS 6.5) in Inspircd, published September 11, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.79%, the 86th percentile. Fixed in inspircd 3.3.0-1.
References
docs.inspircd.org/security/2019-02
github.com/inspircd/inspircd/commit/2cc35d8625b7ea5cbd1d1ebb116aff86c5280162
debian.org/security/2020/dsa-4764
lists.debian.org/debian-lts-announce/2020/09/msg00015.html
nvd.nist.gov/vuln/detail/CVE-2019-20917