WaratekVRT Sign in

CVE-2020-1752 glibc

Affected softwareglibc
Severity7.0 High CVSS 3.1 3 scores
WeaknessUse after free (CWE-416)
Published30 Apr 2020
Updated14 Oct 2026

Description

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 6 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 0.55% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

7.0 HIGH v3.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.0 HIGH CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H secalert@redhat.com Secondary published
CVSS 3.1 7.0 HIGH CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H NVD Primary
CVSS 2.0 3.7 none AV:L/AC:H/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Products and versions

8 products, 10 version entries
SourceVendorProductSchemeAffected versions
nvd canonical ubuntu linux generic 16.04 · 18.04 · 19.10
nvd debian debian linux generic 10.0
nvd gnu glibc generic ＜ 2.32.0
nvd netapp active iq unified manager generic ≥ 9.5
nvd netapp h410c firmware generic any version
nvd netapp hci management node generic any version
nvd netapp solidfire generic any version
nvd netapp steelstore cloud integrated storage generic any version

References

URLTags
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1752 Issue Tracking, Patch, Third Party Advisory
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202101-20 Third Party Advisory
https://security.netapp.com/advisory/ntap-20200511-0005/ Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=25414 Issue Tracking, Patch, Third Party Advisory
https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ddc650e9b3dc916eab417ce9f79e67337b05035c
https://usn.ubuntu.com/4416-1/ Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Timeline
Published2020-04-30By the CVE Program.
NVD record modified2026-10-14NVD's own last-modified date for this record.