CVE-2020-29363
An issue was discovered in p11-kit 0.23.6 through 0.23.21.
Published Dec 16, 2020 · updated Oct 14, 2026 · p11-kit project p11-kit
An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Dec 16, 2020 · NIST NVD
Detected
An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value.
Oct 14, 2026 · NIST NVD
Updated
An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value.
Affected
- cpe debian/debian linux10.0
- cpe oracle/communications cloud native core policy1.14.0
- cpe p11-kit project/p11-kitversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2020-29363
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2020-29363
30-day exploitation probability 3.5%
first.org - NIST NVDVulnerability recordCVE-2020-29363
An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving
nvd.nist.gov