{"id":"CVE-2020-7217","aliases":["EUVD-2020-28349","GHSA-j299-xp2p-5fm9","SUSE-SU-2020:0347-1","SUSE-SU-2020:0351-1","SUSE-SU-2020:0358-1","SUSE-SU-2020:0369-1","SUSE-SU-2020:0370-1","SUSE-SU-2020:0410-1","openSUSE-SU-2020:0207-1","openSUSE-SU-2024:11511-1"],"status":"published","title":"An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows...","description":"An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01638,"percentile":0.76516,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-401","CWE-772"],"published":"2020-02-06T12:23:08Z","modified":"2026-10-20T10:53:30Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.60-3.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.60-3.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.60-3.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.60-28.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.60-28.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.60-2.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.60-2.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.60-2.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.60-3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.60-3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.60-3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.60-3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.60-3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.60-lp151.2.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.66-1.2"}]}],"bundled":4}],"products":[{"vendor":"opensuse","product":"wicked"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1160906","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7217/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/openSUSE/wicked/releases","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7217"},{"url":"https://github.com/advisories/GHSA-j299-xp2p-5fm9"},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200347-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1160904","tags":["report"]},{"url":"https://bugzilla.suse.com/1160906","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7217","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200351-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1142214","tags":["report"]},{"url":"https://bugzilla.suse.com/1160903","tags":["report"]},{"url":"https://bugzilla.suse.com/1160905","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7216","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200358-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200369-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200370-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200410-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/APEQDGP47KSKMMNLKISL5AFVZAWLHZQJ/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-7217","description":"An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id.","status":"published","published":"2020-02-10T21:32:25Z","modified":"2024-08-04T09:25:48.338Z","updated_at":"2026-11-02T14:35:58.787905Z"}],"euvd":[{"id":"EUVD-2020-28349","description":"An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id.","status":"published","published":"2020-02-10T21:32:25Z","modified":"2024-08-04T09:25:48Z","updated_at":"2026-11-03T03:08:00.597336Z"}],"ghsa":[{"id":"GHSA-j299-xp2p-5fm9","title":"An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows...","description":"An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id.","status":"published","published":"2022-05-24T17:08:43Z","modified":"2023-01-29T05:01:31Z","cwes":["CWE-401","CWE-772"],"updated_at":"2026-11-02T14:44:50.331765Z"}],"nvd":[{"id":"CVE-2020-7217","description":"An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id.","status":"published","published":"2020-02-11T12:15:21.273Z","modified":"2026-06-17T03:24:31.897Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:05:53.837808Z"}],"osv":[{"id":"CVE-2020-7217","description":"An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id.","status":"published","published":"2020-02-11T12:15:21.273Z","modified":"2026-10-20T10:53:30.436335016Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"openSUSE-SU-2020:0207-1","title":"Security update for wicked","description":"This update for wicked fixes the following issues:\n\n- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).\n- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-02-11T17:13:21Z","modified":"2026-02-04T03:37:04.19353Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11511-1","title":"wicked-0.6.66-1.2 on GA media","description":"These are all security issues fixed in the wicked-0.6.66-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:08:26.774237Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2020:0347-1","title":"Security update for wicked","description":"This update for wicked fixes the following issues:\n\n- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).\n- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).\n","status":"published","published":"2020-02-06T12:23:08Z","modified":"2026-02-04T02:15:04.386776Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0351-1","title":"Security update for wicked","description":"This update for wicked fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903).\n- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).\n- CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905).\n- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).\n\nNon-security issue fixed:\n\n- dhcp4: Fixed an intermittent hang during network setup by cleaning up the defer timer pointer (bsc#1142214).\n","status":"published","published":"2020-02-06T14:25:48Z","modified":"2026-02-04T02:17:38.205255Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0358-1","title":"Security update for wicked","description":"This update for wicked fixes the following issues:\n\n- CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903).\n- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).\n- CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905).\n- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).\n","status":"published","published":"2020-02-07T09:37:47Z","modified":"2026-02-04T03:24:47.504123Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0369-1","title":"Security update for wicked","description":"This update for wicked fixes the following issues:\n\n- CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903).\n- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).\n- CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905).\n- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).\n","status":"published","published":"2020-02-07T12:57:06Z","modified":"2026-02-04T04:26:09.371589Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0370-1","title":"Security update for wicked","description":"This update for wicked fixes the following issues:\n\n- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).\n- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).\n","status":"published","published":"2020-02-07T12:57:34Z","modified":"2026-02-04T02:27:40.997834Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0410-1","title":"Security update for wicked","description":"This update for wicked fixes the following issues:\n\n- CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903).\n- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).\n- CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905).\n- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).\n","status":"published","published":"2020-02-19T08:34:17Z","modified":"2026-02-04T04:10:54.956276Z","updated_at":"2026-11-02T15:53:47.06185Z"}]}}