High
Security advisory
It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-5208
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:36 UTC · Revision 1
Source evidence
It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19.
osv:CVE-2020-5208
Complete source record
{
"id": "61482c24f332cb107b5ec973396943052ad6cc447d96af012fa899672241be7a",
"url": "https://osv.dev/vulnerability/CVE-2020-5208",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-5208",
"summary": "It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19.",
"evidence": "osv:CVE-2020-5208",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-5208",
"aliases": [
"CVE-2020-5208",
"GHSA-g659-9qxw-p7cp"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/ipmitool/ipmitool",
"type": "GIT",
"events": [
{
"introduced": "b5ce925744851b58193ad3ee18957ce88f6efc26"
},
{
"last_affected": "b5ce925744851b58193ad3ee18957ce88f6efc26"
},
{
"fixed": "e824c23316ae50beb7f7488f2055ac65e8b341f2"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:ipmitool_project:ipmitool:1.8.18:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.8.18"
},
{
"last_affected": "1.8.18"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "e824c23316ae50beb7f7488f2055ac65e8b341f2"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"1.8.18",
"IPMITOOL_1_8_18"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5208.json",
"vanir_signatures": [
{
"id": "CVE-2020-5208-361d9920",
"digest": {
"length": 1701,
"function_hash": "192886428758089050892367244975157064793"
},
"source": "https://github.com/ipmitool/ipmitool/commit/e824c23316ae50beb7f7488f2055ac65e8b341f2",
"target": {
"file": "lib/ipmi_fru.c",
"function": "read_fru_area_section"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-5208-95bc5e1f",
"digest": {
"length": 2145,
"function_hash": "134019777437021869972891340940394982863"
},
"source": "https://github.com/ipmitool/ipmitool/commit/e824c23316ae50beb7f7488f2055ac65e8b341f2",
"target": {
"file": "lib/ipmi_fru.c",
"function": "read_fru_area"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-5208-facc6859",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57076867987319810854233613857946262088",
"236455093077017610747203830435885499403",
"50302983535718889553902051495726656844",
"127240053834604641190049528171308280594",
"171490552444983707541313881547760775382",
"159468252494031490108302431114206618012",
"90869396626081300417576987662951969291",
"158296759207413761725236324976059046106",
"333449966720909451653097200969841430185",
"243363549478903765859419170374154158847",
"168649472567545880875518271251405817713",
"44295945655746834570285452179811915295",
"99042831342086855809199899281077268132",
"69275239738053955360996024045230482674",
"182594728877648145376787303490332092721",
"13648507444097223767168718815638888394",
"315387753671988408139076220211215164454",
"82436235867193713512548748195290102799",
"204427108457237212630070253610306739008",
"25471238540442471233640752005268856307",
"83292191667530993419136007046260669268",
"265184154697531959962865615124016063860",
"265745931496434714655901594370802605299",
"74275860038477994846903371863830996366",
"287124388342538269033154908689897118951",
"127240053834604641190049528171308280594",
"171490552444983707541313881547760775382",
"159468252494031490108302431114206618012",
"90869396626081300417576987662951969291",
"158296759207413761725236324976059046106",
"333449966720909451653097200969841430185",
"243363549478903765859419170374154158847",
"168649472567545880875518271251405817713",
"44295945655746834570285452179811915295",
"126802022020050959000339982198636948947",
"227796436680837261900849338051402674176",
"193245646791272897850468398052174396305",
"92560596906955904854177872398064960912",
"13648507444097223767168718815638888394",
"167307511504313380807613353316085981725",
"168357358145000016114140709761680186784",
"336451364272383594355124115874525625255",
"33785226047952495029146364540215980849",
"192128900186167947288651281698769174820"
]
},
"source": "https://github.com/ipmitool/ipmitool/commit/e824c23316ae50beb7f7488f2055ac65e8b341f2",
"target": {
"file": "lib/ipmi_fru.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:59:41Z"
}
}
],
"modified": "2026-10-20T13:59:41.935433079Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K2BPW66KDP4H36AGZXLED57A3O2Y6EQW/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RYYEKUAUTCWICM77HOEGZDVVEUJLP4BP/",
"https://lists.debian.org/debian-lts-announce/2020/02/msg00006.html",
"https://lists.debian.org/debian-lts-announce/2021/06/msg00029.html",
"https://security.gentoo.org/glsa/202101-03",
"https://github.com/ipmitool/ipmitool/commit/e824c23316ae50beb7f7488f2055ac65e8b341f2",
"https://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "30"
},
{
"last_affected": "30"
},
{
"introduced": "31"
},
{
"last_affected": "31"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "15.1"
},
{
"last_affected": "15.1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-5208",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388500,
"published_at": "2020-02-05T14:15:11.42+00:00"
}