Apache Guacamole Race Condition vulnerability

Also known as GHSA-3vv3-585q-wv6x

Published 8 y ago 2018-01-18 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.2%

percentile 69%

Public exploits

none known

A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end of a statically-allocated buffer.

Exploit prediction (EPSS)

1.22% probability of exploitation in the next 30 days, higher than 69% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.1	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`
GitHub	3.0	8.1	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.guacamole:guacamole-common`	>=0.9.5, <0.9.11-incubating	0.9.11-incubating

Affected products

Apache Software Foundation Apache Guacamole

Classification

Weakness

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

lists.apache.org /thread.html/b218d36bfdaf655d27382daec4dcd02ec717631f4aee8b7e4300ad65%40%3Cuser.guacamole. · x_refsource_MISC, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-3158 · advisory
lists.apache.org /thread.html/b218d36bfdaf655d27382daec4dcd02ec717631f4aee8b7e4300ad65@%3Cuser.guacamole.ap · web

Sources

CVE List: CVE-2017-3158
GitHub Advisory: GHSA-3vv3-585q-wv6x
NVD: CVE-2017-3158

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary