CVE-2019-20917

Name	CVE-2019-20917
Description	An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2375-1, DSA-4764-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
inspircd (PTS)	bullseye	3.8.1-2	fixed
	bookworm	3.15.0-1	fixed
	sid, trixie	3.17.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
inspircd	source	stretch	2.0.23-2+deb9u1	DLA-2375-1
inspircd	source	buster	2.0.27-1+deb10u1	DSA-4764-1
inspircd	source	(unstable)	3.3.0-1

Notes

https://docs.inspircd.org/security/2019-02/
https://github.com/inspircd/inspircd/commit/2cc35d8625b7ea5cbd1d1ebb116aff86c5280162 (v2)
https://github.com/inspircd/inspircd/commit/8745660fcdac7c1b80c94cfc0ff60928cd4dd4b7 (v3)