CVE-2019-20919

An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference.

• CWE-476

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00012.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00013.htmlMailing List, Third Party Advisory
• https://github.com/perl5-dbi/dbi/commit/eca7d7c8f43d96f6277e86d1000e842eb4cc67ffPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/09/msg00026.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXLKODJ7B57GITDEZZXNSHPK4VBYXYHR/
• https://metacpan.org/pod/distribution/DBI/Changes#Changes-in-DBI-1.643-...Third Party Advisory
• https://usn.ubuntu.com/4534-1/Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00012.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00013.htmlMailing List, Third Party Advisory
• https://github.com/perl5-dbi/dbi/commit/eca7d7c8f43d96f6277e86d1000e842eb4cc67ffPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/09/msg00026.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXLKODJ7B57GITDEZZXNSHPK4VBYXYHR/
• https://metacpan.org/pod/distribution/DBI/Changes#Changes-in-DBI-1.643-...Third Party Advisory
• https://usn.ubuntu.com/4534-1/Third Party Advisory

Published

Sep 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-20913An issue was discovered in GNU LibreDWG through 0.9.3. Craft…8.1
• CVE-2019-20914An issue was discovered in GNU LibreDWG through 0.9.3. There…9.8
• CVE-2019-20915An issue was discovered in GNU LibreDWG through 0.9.3. Craft…8.1
• CVE-2019-20916The pip package before 19.2 for Python allows Directory Trav…7.5
• CVE-2019-20917An issue was discovered in InspIRCd 2 before 2.0.28 and 3 be…6.5
• CVE-2019-20918An issue was discovered in InspIRCd 3 before 3.1.0. The sile…6.5
• CVE-2019-2092In isSeparateProfileChallengeAllowed of DevicePolicyManagerS…
• CVE-2019-20920Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable t…8.1
• CVE-2019-20921bootstrap-select before 1.13.6 allows Cross-Site Scripting (…6.1
• CVE-2019-20922Handlebars before 4.4.5 allows Regular Expression Denial of …7.5
• CVE-2019-20923A user authorized to perform database queries may trigger de…6.5
• CVE-2019-20924A user authorized to perform database queries may trigger de…6.5