PatchTheCVEopen tftp server vulnerabilities and fixes
Recent CVEs affecting open tftp server, with upgrade or downgrade steps. 6 tracked.
Also searched as: opentftpserver.
open tftp server has 6 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 5. Most recent: 2020-10-28. Highest priority: CVE-2018-10388 (score 62/100).
- CVE-2020-26130 HIGH 7.8 DOWNGRADE Issues were discovered in Open TFTP Server multithreaded 1.66 and Open TFTP Server single port 1.66
- CVE-2019-12568 CRITICAL 9.8 UPGRADE Stack-based overflow vulnerability in the logMess function in Open TFTP Server SP 1.66 and earlier allows remo
- CVE-2019-12567 CRITICAL 9.8 UPGRADE Stack-based overflow vulnerability in the logMess function in Open TFTP Server MT 1.65 and earlier allows remo
- CVE-2018-10389 CRITICAL 9.8 UPGRADE Format string vulnerability in the logMess function in TFTP Server MT 1.65 and earlier allows remote attackers
- CVE-2018-10388 CRITICAL 9.8 UPGRADE Format string vulnerability in the logMess function in TFTP Server SP 1.66 and earlier allows remote attackers
- CVE-2018-10387 CRITICAL 9.8 UPGRADE Heap-based overflow vulnerability in TFTP Server SP 1.66 and earlier allows remote attackers to perform a deni
FAQ
How do I fix open tftp server vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is open tftp server being exploited right now?
None of the tracked open tftp server CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which open tftp server CVE should I patch first?
CVE-2018-10388 currently ranks highest (62/100): Format string vulnerability in the logMess function in TFTP Server SP 1.66 and earlier allows remote attackers.