CVE-2021-20272

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A flaw was found in privoxy before 3.0.32. An assertion failure could be triggered with a crafted CGI request leading to server crash.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-617

Affected software

Vendor	Product	Versions
n/a	privoxy	privoxy 3.0.32

References

https://bugzilla.redhat.com/show_bug.cgi?id=1936651Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00009.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202107-16Third Party Advisory
https://www.privoxy.org/announce.txtVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1936651Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00009.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202107-16Third Party Advisory
https://www.privoxy.org/announce.txtVendor Advisory

Timeline

Published: Mar 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-202737.5A flaw was found in privoxy before 3.0.32. A crash can occur via a crafted CGI request if Privoxy is toggled off.CVE-2021-202747.5A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbehaves.CVE-2021-202757.5A flaw was found in privoxy before 3.0.32. A invalid read of size two may occur in chunked_body_is_complete() leading to denial of service.CVE-2021-202767.5A flaw was found in privoxy before 3.0.32. Invalid memory access with an invalid pattern passed to pcre_compile() may lead to denial of serv CVE-2021-202777.5A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, lea CVE-2021-202786.5An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used. When CVE-2021-202795.4The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.CVE-2021-20284.9Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.21 and prior. Ea CVE-2021-202805.4Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8,CVE-2021-202815.3It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.CVE-2021-202825.3When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle be CVE-2021-202834.3The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that