CVE-2019-20485

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage).

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=953078Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1809740Issue Tracking, Vendor Advisory
https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=a663a860819287e041c3de672aad1d8543098ecc
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5GE6ISYUL3CIWO3FQRUGMKTKP2NYED2/
https://security-tracker.debian.org/tracker/CVE-2019-20485Third Party Advisory
https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1730509.html
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=953078Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1809740Issue Tracking, Vendor Advisory
https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=a663a860819287e041c3de672aad1d8543098ecc
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5GE6ISYUL3CIWO3FQRUGMKTKP2NYED2/
https://security-tracker.debian.org/tracker/CVE-2019-20485Third Party Advisory
https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1730509.html

Timeline

Published: Mar 19, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-204866.1An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple pages (setup.cgi and adv_index.htm) within the web management consol CVE-2019-204878.8An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the WNR1000V4 web management console are vulnerable t CVE-2019-204889.8An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the web management interface (setup.cgi) are vulnerab CVE-2019-204899.8An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface (setup.cgi) has an authentication bypass and oth CVE-2019-20497.8In SendMediaUpdate and SendFolderUpdate of avrcp_service.cc, there is a possible memory corruption due to a use after free. This could lead CVE-2019-204908.8cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).CVE-2019-204915.4cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508).CVE-2019-204928.8cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).CVE-2019-204936.1cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).CVE-2019-204943.3In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).CVE-2019-204956.5cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).CVE-2019-204965.5cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).