CVE-2020-6923

A flaw was found in HPLIP. A heap-based overflow in the mdns_readName function and a stack-based overflow in the mdns_update_uris function can be triggered when processing specially crafted mDNS responses. This vulnerability allows an attacker on the local network to crash the application, resulting in a denial of service or potentially allowing code execution.

This vulnerability allows an unauthenticated attacker on the same network to cause a denial of service or potentially achieve remote code execution. For these reasons, this issue has been rated with an important severity.

Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, consider removing the hplip package if its functionality is not required by using the command indicated below. Note this will remove HP printer support and related utilities from the system.

sudo dnf remove hplip