CVE-2021-44508

moderate-risk

Published 2022-04-15

An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). A lack of NULL checks in calls to ious_open in sr_unix/ious_open.c allows attackers to crash the application by dereferencing a NULL pointer.

Do I need to act?

0.37% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (1)

Gt.M

Affected Vendors

Fisglobal

References (6)

Release Notes http://tinco.pair.com/bhaskar/gtm/doc/articles/GTM_V7.0-002_Release_Notes.html

Issue Tracking https://gitlab.com/YottaDB/DB/YDB/-/issues/828

Third Party Advisory https://sourceforge.net/projects/fis-gtm/files/

Release Notes http://tinco.pair.com/bhaskar/gtm/doc/articles/GTM_V7.0-002_Release_Notes.html

Issue Tracking https://gitlab.com/YottaDB/DB/YDB/-/issues/828

Third Party Advisory https://sourceforge.net/projects/fis-gtm/files/

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal