Every CVE Search/ Get API key

CVE-2021-20274

A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when...

7.5 HighFix available

A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbehaves.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.92%Up 1.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbehaves.

Record
CVE-2021-20274
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbehaves.

Record
CVE-2021-20274
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2021-7708 No score

A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbehaves.

Record
EUVD-2021-7708
Updated
2026-11-03
GitHub AdvisoriesGHSA-g899-mr4g-v86j No score

A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when...

A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbehaves.

Record
GHSA-g899-mr4g-v86j
Weakness
CWE-476
Updated
2026-11-02
OSVALPINE-CVE-2021-20274 7.5

A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbehaves.

Record
ALPINE-CVE-2021-20274
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbehaves.

Record
CVE-2021-20274
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2021-20274 7.5

A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbehaves.

Record
DEBIAN-CVE-2021-20274
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2021:0443-1 No score

Security update for privoxy

This update for privoxy fixes the following issues:

Update to version 3.0.32:

  • Security/Reliability (boo#1183129)

    • ssplit(): Remove an assertion that could be triggered with a crafted CGI request. Commit 2256d7b4d67. OVE-20210203-0001. CVE-2021-20272 Reported by: Joshua Rogers (Opera)
    • cgi_send_banner(): Overrule invalid image types. Prevents a crash with a crafted CGI request if Privoxy is toggled off. Commit e711c505c48. OVE-20210206-0001. CVE-2021-20273 Reported by: Joshua Rogers (Opera)
    • socks5_connect(): Don't try to send credentials when none are configured. Fixes a crash due to a NULL-pointer dereference when the socks server misbehaves. Commit 85817cc55b9. OVE-20210207-0001. CVE-2021-20274 Reported by: Joshua Rogers (Opera)
    • chunked_body_is_complete(): Prevent an invalid read of size two. Commit a912ba7bc9c. OVE-20210205-0001. CVE-2021-20275 Reported by: Joshua Rogers (Opera)
    • Obsolete pcre: Prevent invalid memory accesses with an invalid pattern passed to pcre_compile(). Note that the obsolete pcre code is scheduled to be removed before the 3.0.33 release. There has been a warning since 2008 already. Commit 28512e5b624. OVE-20210222-0001. CVE-2021-20276 Reported by: Joshua Rogers (Opera)

  • Bug fixes:

    • Properly parse the client-tag-lifetime directive. Previously it was not accepted as an obsolete hash value was being used. Reported by: Joshua Rogers (Opera)
    • decompress_iob(): Prevent reading of uninitialized data. Reported by: Joshua Rogers (Opera).
    • decompress_iob(): Don't advance cur past eod when looking for the end of the file name and comment.
    • decompress_iob(): Cast value to unsigned char before shifting. Prevents a left-shift of a negative value which is undefined behaviour. Reported by: Joshua Rogers (Opera)
    • gif_deanimate(): Confirm that that we have enough data before doing any work. Fixes a crash when fuzzing with an empty document. Reported by: Joshua Rogers (Opera).
    • buf_copy(): Fail if there's no data to write or nothing to do. Prevents undefined behaviour 'applying zero offset to null pointer'. Reported by: Joshua Rogers (Opera)
    • log_error(): Treat LOG_LEVEL_FATAL as fatal even when --stfu is being used while fuzzing. Reported by: Joshua Rogers (Opera).
    • Respect DESTDIR when considering whether or not to install config files with '.new' extension.
    • OpenSSL ssl_store_cert(): Fix two error messages.
    • Fix a couple of format specifiers.
    • Silence compiler warnings when compiling with NDEBUG.
    • fuzz_server_header(): Fix compiler warning.
    • fuzz_client_header(): Fix compiler warning.
    • cgi_send_user_manual(): Also reject requests if the user-manual directive specifies a https:// URL. Previously Privoxy would try and fail to open a local file.

  • General improvements:

    • Log the TLS version and the the cipher when debug 2 is enabled.
    • ssl_send_certificate_error(): Respect HEAD requests by not sending a body.
    • ssl_send_certificate_error(): End the body with a single new line.
    • serve(): Increase the chances that the host is logged when closing a server socket.
    • handle_established_connection(): Add parentheses to clarify an expression Suggested by: David Binderman
    • continue_https_chat(): Explicitly unset CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE if process_encrypted_request() fails. This makes it more obvious that the connection will not be reused. Previously serve() relied on CSP_FLAG_SERVER_CONTENT_LENGTH_SET and CSP_FLAG_CHUNKED being unset. Inspired by a patch from Joshua Rogers (Opera).
    • decompress_iob(): Add periods to a couple of log messages
    • Terminate the body of the HTTP snipplets with a single new line instead of '\r\n'. -…
Record
openSUSE-SU-2021:0443-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:0460-1 No score

Security update for privoxy

This update for privoxy fixes the following issues:

Update to version 3.0.32:

  • Security/Reliability (boo#1183129)

    • ssplit(): Remove an assertion that could be triggered with a crafted CGI request. Commit 2256d7b4d67. OVE-20210203-0001. CVE-2021-20272 Reported by: Joshua Rogers (Opera)
    • cgi_send_banner(): Overrule invalid image types. Prevents a crash with a crafted CGI request if Privoxy is toggled off. Commit e711c505c48. OVE-20210206-0001. CVE-2021-20273 Reported by: Joshua Rogers (Opera)
    • socks5_connect(): Don't try to send credentials when none are configured. Fixes a crash due to a NULL-pointer dereference when the socks server misbehaves. Commit 85817cc55b9. OVE-20210207-0001. CVE-2021-20274 Reported by: Joshua Rogers (Opera)
    • chunked_body_is_complete(): Prevent an invalid read of size two. Commit a912ba7bc9c. OVE-20210205-0001. CVE-2021-20275 Reported by: Joshua Rogers (Opera)
    • Obsolete pcre: Prevent invalid memory accesses with an invalid pattern passed to pcre_compile(). Note that the obsolete pcre code is scheduled to be removed before the 3.0.33 release. There has been a warning since 2008 already. Commit 28512e5b624. OVE-20210222-0001. CVE-2021-20276 Reported by: Joshua Rogers (Opera)

  • Bug fixes:

    • Properly parse the client-tag-lifetime directive. Previously it was not accepted as an obsolete hash value was being used. Reported by: Joshua Rogers (Opera)
    • decompress_iob(): Prevent reading of uninitialized data. Reported by: Joshua Rogers (Opera).
    • decompress_iob(): Don't advance cur past eod when looking for the end of the file name and comment.
    • decompress_iob(): Cast value to unsigned char before shifting. Prevents a left-shift of a negative value which is undefined behaviour. Reported by: Joshua Rogers (Opera)
    • gif_deanimate(): Confirm that that we have enough data before doing any work. Fixes a crash when fuzzing with an empty document. Reported by: Joshua Rogers (Opera).
    • buf_copy(): Fail if there's no data to write or nothing to do. Prevents undefined behaviour 'applying zero offset to null pointer'. Reported by: Joshua Rogers (Opera)
    • log_error(): Treat LOG_LEVEL_FATAL as fatal even when --stfu is being used while fuzzing. Reported by: Joshua Rogers (Opera).
    • Respect DESTDIR when considering whether or not to install config files with '.new' extension.
    • OpenSSL ssl_store_cert(): Fix two error messages.
    • Fix a couple of format specifiers.
    • Silence compiler warnings when compiling with NDEBUG.
    • fuzz_server_header(): Fix compiler warning.
    • fuzz_client_header(): Fix compiler warning.
    • cgi_send_user_manual(): Also reject requests if the user-manual directive specifies a https:// URL. Previously Privoxy would try and fail to open a local file.

  • General improvements:

    • Log the TLS version and the the cipher when debug 2 is enabled.
    • ssl_send_certificate_error(): Respect HEAD requests by not sending a body.
    • ssl_send_certificate_error(): End the body with a single new line.
    • serve(): Increase the chances that the host is logged when closing a server socket.
    • handle_established_connection(): Add parentheses to clarify an expression Suggested by: David Binderman
    • continue_https_chat(): Explicitly unset CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE if process_encrypted_request() fails. This makes it more obvious that the connection will not be reused. Previously serve() relied on CSP_FLAG_SERVER_CONTENT_LENGTH_SET and CSP_FLAG_CHUNKED being unset. Inspired by a patch from Joshua Rogers (Opera).
    • decompress_iob(): Add periods to a couple of log messages
    • Terminate the body of the HTTP snipplets with a single new line instead of '\r\n'. -…
Record
openSUSE-SU-2021:0460-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11193-1 No score

privoxy-3.0.32-2.3 on GA media

These are all security issues fixed in the privoxy-3.0.32-2.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11193-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
privoxy
Alpine:v3.12
 before 3.0.32-r0
3.0.32-r0
privoxy
Alpine:v3.13
 before 3.0.32-r0
3.0.32-r0
privoxy
Alpine:v3.14
 before 3.0.32-r0
3.0.32-r0
privoxy
Alpine:v3.15
 before 3.0.32-r0
3.0.32-r0
privoxy
Alpine:v3.16
 before 3.0.32-r0
3.0.32-r0
privoxy
Alpine:v3.17
 before 3.0.32-r0
3.0.32-r0
privoxy
Alpine:v3.18
 before 3.0.32-r0
3.0.32-r0
privoxy
Alpine:v3.19
 before 3.0.32-r0
3.0.32-r0
privoxy
Alpine:v3.20
 before 3.0.32-r0
3.0.32-r0
privoxy
Alpine:v3.21
 before 3.0.32-r0
3.0.32-r0
Show 9 moreShow less
Affected packages
PackageAffectedFixed
privoxy
Alpine:v3.22
 before 3.0.32-r0
3.0.32-r0
privoxy
Alpine:v3.23
 before 3.0.32-r0
3.0.32-r0
privoxy
Alpine:v3.24
 before 3.0.32-r0
3.0.32-r0
privoxy
Debian:12
 before 3.0.32-1
3.0.32-1
privoxy
Debian:13
 before 3.0.32-1
3.0.32-1
privoxy
Debian:14
 before 3.0.32-1
3.0.32-1
privoxy
openSUSE:Leap 15.2
From an advisory covering 5 CVEs
 before 3.0.32-lp152.3.9.1
3.0.32-lp152.3.9.1
privoxy
SUSE:Package Hub 15 SP2
From an advisory covering 5 CVEs
 before 3.0.32-bp152.4.9.1
3.0.32-bp152.4.9.1
privoxy
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 3.0.32-2.3
3.0.32-2.3

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-20274 is a high vulnerability (CVSS 7.5) in Privoxy, published March 9, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.92%, the 79th percentile. Fixed in privoxy 3.0.32-r0.

References

Show 11 moreShow less
This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open