CVE-2020-17498: 
Wireshark vulnerability analysis and mitigation

CVE-2020-17498 affects Wireshark versions 3.2.0 to 3.2.5, specifically impacting the Kafka protocol dissector. The vulnerability was discovered and disclosed in August 2020, and involves a potential crash due to a double free during LZ4 decompression in the epan/dissectors/packet-kafka.c component (MITRE CVE, Wireshark Advisory).

The vulnerability stems from a double free condition in the Kafka protocol dissector's handling of LZ4 decompression. The issue was addressed in epan/dissectors/packet-kafka.c by implementing proper memory management to avoid the double free scenario. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium), with attack vector being Network, attack complexity Low, requiring user interaction, and potentially resulting in high availability impact (Ubuntu Security).

A successful exploitation of this vulnerability could cause Wireshark to crash, resulting in a denial of service condition. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (Gentoo Security).

The vulnerability can be exploited by either injecting a malformed packet onto the network or by convincing a user to open a malformed packet trace file. The attack requires user interaction but can be initiated remotely (Wireshark Advisory).

The vulnerability was fixed in Wireshark version 3.2.6. Users are strongly recommended to upgrade to this version or later. Various Linux distributions have also released security updates to address this vulnerability, including Ubuntu (3.2.3-1ubuntu0.1~esm1), Fedora, and OpenSUSE (Ubuntu Security, Gentoo Security).