{"id":"CVE-2020-14382","aliases":["ALPINE-CVE-2020-14382","BELL-CVE-2020-14382","DEBIAN-CVE-2020-14382","EUVD-2020-6522","GHSA-v8mw-xqhr-2vqp","RHSA-2020:4542","RHSA-2020:4900","RHSA-2021:0258","UBUNTU-CVE-2020-14382","USN-4493-1","openSUSE-SU-2024:10704-1"],"status":"published","title":"A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2...","description":"A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement \"intervals = malloc(first_backup * sizeof(*intervals));\"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01157,"percentile":0.67472,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2020-09-03T00:00:00Z","modified":"2026-10-26T12:02:27Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"cryptsetup","fixed_in":["2.2.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"cryptsetup","fixed_in":["2.3.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"cryptsetup","fixed_in":["2.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"cryptsetup","fixed_in":["2.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"cryptsetup","fixed_in":["2.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"cryptsetup","fixed_in":["2.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"cryptsetup","fixed_in":["2.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"cryptsetup","fixed_in":["2.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"cryptsetup","fixed_in":["2.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"cryptsetup","fixed_in":["2.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"cryptsetup","fixed_in":["2.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cryptsetup","fixed_in":["2.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cryptsetup","fixed_in":["2.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cryptsetup","fixed_in":["2.3.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cryptsetup","fixed_in":["2:2.3.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cryptsetup","fixed_in":["2:2.3.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cryptsetup","fixed_in":["2:2.3.4-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-debuginfo","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-debugsource","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-devel","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-libs-debuginfo","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-reencrypt-debuginfo","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"integritysetup-debuginfo","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"veritysetup-debuginfo","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-debuginfo","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-debugsource","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-libs","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-libs-debuginfo","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-reencrypt","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-reencrypt-debuginfo","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"integritysetup","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"integritysetup-debuginfo","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"veritysetup","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"veritysetup-debuginfo","fixed_in":["0:2.3.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cryptsetup-debuginfo","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cryptsetup-debugsource","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cryptsetup-devel","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cryptsetup-libs-debuginfo","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cryptsetup-reencrypt-debuginfo","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"integritysetup-debuginfo","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"veritysetup-debuginfo","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"cryptsetup","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"cryptsetup-debuginfo","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"cryptsetup-debugsource","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"cryptsetup-libs","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"cryptsetup-libs-debuginfo","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"cryptsetup-reencrypt","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"cryptsetup-reencrypt-debuginfo","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"integritysetup","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"integritysetup-debuginfo","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"veritysetup","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"veritysetup-debuginfo","fixed_in":["0:2.2.0-2.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cryptsetup-debuginfo","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cryptsetup-debugsource","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cryptsetup-devel","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cryptsetup-libs-debuginfo","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cryptsetup-reencrypt-debuginfo","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"integritysetup-debuginfo","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"veritysetup-debuginfo","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cryptsetup","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cryptsetup-debuginfo","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cryptsetup-debugsource","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cryptsetup-libs","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cryptsetup-libs-debuginfo","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cryptsetup-reencrypt","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cryptsetup-reencrypt-debuginfo","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"integritysetup","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"integritysetup-debuginfo","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"veritysetup","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"veritysetup-debuginfo","fixed_in":["0:2.2.2-1.el8_2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"cryptsetup","fixed_in":["2:2.2.2-3ubuntu2.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cryptsetup","fixed_in":["2.4.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-reencrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"integritysetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"veritysetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-reencrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-reencrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"integritysetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"integritysetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"veritysetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"veritysetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cryptsetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cryptsetup-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cryptsetup-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cryptsetup-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cryptsetup-reencrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"integritysetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"veritysetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"cryptsetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"cryptsetup-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"cryptsetup-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"cryptsetup-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"cryptsetup-reencrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"cryptsetup-reencrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"integritysetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"integritysetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"veritysetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"veritysetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cryptsetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cryptsetup-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cryptsetup-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cryptsetup-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cryptsetup-reencrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"integritysetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"veritysetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cryptsetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cryptsetup-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cryptsetup-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cryptsetup-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cryptsetup-reencrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cryptsetup-reencrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"integritysetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"integritysetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"veritysetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"veritysetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-1.el8_2.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.2-3ubuntu2.2"}]}],"versions":["2:2.2.0-3ubuntu1","2:2.2.1-1ubuntu1","2:2.2.2-1ubuntu1","2:2.2.2-2ubuntu1","2:2.2.2-3ubuntu1","2:2.2.2-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.2-3ubuntu2.2"}]}],"versions":["2:2.2.0-3ubuntu1","2:2.2.1-1ubuntu1","2:2.2.2-1ubuntu1","2:2.2.2-2ubuntu1","2:2.2.2-3ubuntu1","2:2.2.2-3ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-1.1"}]}]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"cryptsetup_project","product":"cryptsetup"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"microsoft","product":"cryptsetup"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1874712","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://usn.ubuntu.com/4493-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OJTQ4KSVCW2NMSU5WFVPOHY46WMNF4OB/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD6YSD63LLRRC4WQ7DJLSXWNUCY6FWBM/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14382","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OJTQ4KSVCW2NMSU5WFVPOHY46WMNF4OB/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TD6YSD63LLRRC4WQ7DJLSXWNUCY6FWBM/"},{"url":"https://github.com/advisories/GHSA-v8mw-xqhr-2vqp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-14382","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-14382","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-14382","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4542","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1743891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1785748","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1796826","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4542.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14382","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14382","tags":["advisory","report"]},{"url":"https://gitlab.com/cryptsetup/cryptsetup/-/blob/master/docs/v2.3.4-ReleaseNotes","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4900","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4900.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0258","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0258.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-14382","tags":["report"]},{"url":"https://gitlab.com/cryptsetup/cryptsetup/-/merge_requests/102","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4493-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14382","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-14382","description":"A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement \"intervals = malloc(first_backup * sizeof(*intervals));\"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.","status":"published","published":"2020-09-16T14:37:52Z","modified":"2024-08-04T12:46:34.336Z","updated_at":"2026-11-02T14:35:46.476719Z"}],"euvd":[{"id":"EUVD-2020-6522","description":"A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement \"intervals = malloc(first_backup * sizeof(*intervals));\"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.","status":"published","published":"2020-09-16T14:37:52Z","modified":"2024-08-04T12:46:34Z","updated_at":"2026-11-03T03:07:34.099541Z"}],"ghsa":[{"id":"GHSA-v8mw-xqhr-2vqp","title":"A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2...","description":"A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement \"intervals = malloc(first_backup * sizeof(*intervals));\"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.","status":"published","published":"2022-05-24T17:28:23Z","modified":"2023-01-29T05:04:03Z","cwes":["CWE-787"],"updated_at":"2026-11-02T14:45:27.507739Z"}],"nvd":[{"id":"CVE-2020-14382","description":"A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement \"intervals = malloc(first_backup * sizeof(*intervals));\"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.","status":"published","published":"2020-09-16T15:15:12.387Z","modified":"2026-06-17T02:54:39.927Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:06:15.83396Z"}],"osv":[{"id":"ALPINE-CVE-2020-14382","description":"A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement \"intervals = malloc(first_backup * sizeof(*intervals));\"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.","status":"published","published":"2020-09-16T15:15:12.387Z","modified":"2026-10-26T11:17:55.126168051Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2020-14382","title":"CVE-2020-14382 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:33.818788Z","modified":"2026-01-26T09:46:21.78935Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-14382","description":"A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement \"intervals = malloc(first_backup * sizeof(*intervals));\"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.","status":"published","published":"2020-09-16T15:15:12.387Z","modified":"2026-10-24T10:30:56.254215248Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-14382","description":"A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement \"intervals = malloc(first_backup * sizeof(*intervals));\"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.","status":"published","published":"2020-09-16T15:15:12.387Z","modified":"2026-10-26T12:02:27.041110158Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"RHSA-2020:4542","title":"Red Hat Security Advisory: cryptsetup security, bug fix, and enhancement update","status":"published","published":"2024-09-16T04:22:18Z","modified":"2026-06-26T12:21:13.697981523Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:4900","title":"Red Hat Security Advisory: cryptsetup security update","status":"published","published":"2024-09-16T04:22:25Z","modified":"2026-06-26T12:22:16.256440078Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2021:0258","title":"Red Hat Security Advisory: cryptsetup security update","status":"published","published":"2024-09-16T04:22:35Z","modified":"2026-06-26T12:22:27.439289457Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"UBUNTU-CVE-2020-14382","description":"A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement \"intervals = malloc(first_backup * sizeof(*intervals));\"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.","status":"published","published":"2020-09-03T00:00:00Z","modified":"2026-04-22T12:30:05.598966Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"openSUSE-SU-2024:10704-1","title":"cryptsetup-2.4.1-1.1 on GA media","description":"These are all security issues fixed in the cryptsetup-2.4.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:41:33.266955Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-4493-1","title":"cryptsetup vulnerability","description":"It was discovered that cryptsetup incorrectly handled certain inputs.\nAn attacker could possibly use this issue to execute arbitrary code.\n","status":"published","published":"2020-09-14T12:23:03Z","modified":"2026-04-22T10:07:42.16689Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}