Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-29361

20
FAUCET Score

CVE-2020-29361 is a high-severity vulnerability affecting p11-kit versions 0.21.1 through 0.23.21, specifically impacting Debian Linux distributions. The vulnerability stems from multiple integer overflows in array allocations within the p11-kit library and the p11-kit list command, due to missing overflow checks before memory reallocation. This could lead to a denial-of-service condition, as indicated by its CVSS score of 7.5. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
>= 0.21.1, <= 0.23.21CPE matchmatch criteria
cpe:2.3:a:p11-kit_project:p11-kit:*:*:*:*:*:*:*:*
9.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
10.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
3.35%
Probability of exploitation in next 30 days
EPSS Percentile
87.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0335 is in the 78th percentile among its peer group of 51,506 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (4)

microsoftpatch availablevia msrc
Product: 19140-16820Fixed in: 0.23.22-1
microsoftpatch availablevia msrc
Product: cm1 p11-kit 0.23.22-1 on CBL Mariner 1.0Fixed in: 0.23.22-1
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: p11-kit-0:0.23.22-1.el8
View patch
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: p11-kit

Vendor Advisories (2)

redhatCVE-2020-29361Moderate

p11-kit: integer overflow when allocating memory for arrays or attributes and object identifiers

Dec 12, 2020
microsoft2020-Dec/CVE-2020-29361Important

An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command where overflow checks are missing before calling realloc or calloc.

Dec 8, 2020

References

github.com / p11-glue/p11-kit/releases
Release NotesThird Party Advisory
github.com / p11-glue/p11-kit/security/advisories/GHSA-q4r3-hm6m-mvc2
Third Party Advisory
lists.apache.org / thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
lists.apache.org / thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
lists.debian.org / debian-lts-announce/2021/01/msg00002.html
Mailing ListThird Party Advisory
debian.org / security/2021/dsa-4822
Third Party Advisory