CVE-2020-13574: 
NixOS vulnerability analysis and mitigation

A denial-of-service vulnerability (CVE-2020-13574) was discovered in the WS-Security plugin functionality of Genivia gSOAP version 2.8.107. The vulnerability was disclosed to the vendor on November 5, 2020, and a patch was released on November 20, 2020, with public disclosure following on January 5, 2021. The vulnerability affects the gSOAP toolkit, which is a C/C++ library for developing XML-based web services (Talos Report).

The vulnerability exists in the WS-Security plugin's handling of KeyInfo elements. Within the KeyInfo element, when a SecurityTokenReference contains a KeyIdentifier element without a ValueType attribute, a null pointer dereference can occur. The issue arises because the keytype variable is set but never validated before use in a strcmp operation. The vulnerability has been assigned a CVSSv3 score of 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is classified as CWE-476 (NULL Pointer Dereference) (Talos Report).

When exploited, this vulnerability can lead to a denial of service condition in applications using the affected gSOAP WS-Security plugin. An attacker can trigger the vulnerability by sending a specially crafted SOAP request to the target system (NVD).

The vulnerability can be exploited remotely by sending an HTTP request containing a specially crafted SOAP message. No authentication is required to exploit this vulnerability, making it particularly concerning for exposed services (Talos Report).

The vulnerability was patched in a gSOAP update released on November 20, 2020. Users are advised to upgrade their gSOAP installations to a version that includes the fix. Multiple Linux distributions have also released security updates to address this vulnerability, including Fedora and Debian (Debian LTS, Fedora Update).