CVE-2020-29363
An issue was discovered in p11-kit 0.23.6 through 0.23.21.
Published Dec 16, 2020 · updated Oct 14, 2026 · p11-kit project p11-kit
An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value.
Timeline
Detection, updates, and resolution for this record.
Dec 16, 2020 · NIST NVD
Detected
An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value.
Oct 14, 2026 · NIST NVD
Updated
An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value.
Affected
- cpe debian/debian linux10.0
- cpe oracle/communications cloud native core policy1.14.0
- cpe p11-kit project/p11-kitversion unspecified
Sources
- CVE.orgCVE-2020-29363
Official CVE identifier
cve.org - FIRST EPSSCVE-2020-29363
30-day exploitation probability 3.5%
first.org - NIST NVDCVE-2020-29363
An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving
nvd.nist.gov