CVE catalog

CVE-2020-6095

gst-rtsp-server1.0: CVE-2020-6095

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Mar 27, 2020, 8:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 2.94% · Oct 25, 2026

An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cause a null pointer deference resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	gst-rtsp-server1.0	sid	`1.28.8-1`	fixed
Debian	gst-rtsp-server1.0	forky	`1.28.8-1`	fixed
Debian	gst-rtsp-server1.0	trixie	`1.26.2-1`	fixed
Debian	gst-rtsp-server1.0	bookworm	`1.22.0-2`	fixed
Ubuntu	gst-rtsp-server1.0	16.04	`1.4.5-2`	vulnerable
Ubuntu	gst-rtsp-server1.0	16.04	`1.6.0-1`	vulnerable
Ubuntu	gst-rtsp-server1.0	16.04	`1.6.1-1`	vulnerable
Ubuntu	gst-rtsp-server1.0	16.04	`1.6.2-1`	vulnerable
Ubuntu	gst-rtsp-server1.0	18.04	`1.12.3-1`	vulnerable
Ubuntu	gst-rtsp-server1.0	18.04	`1.12.4-1`	vulnerable
Ubuntu	gst-rtsp-server1.0	18.04	`1.13.1-1`	vulnerable
Ubuntu	gst-rtsp-server1.0	18.04	`1.13.91-1`	vulnerable
Ubuntu	gst-rtsp-server1.0	18.04	`1.14.0-1`	vulnerable
Ubuntu	gst-rtsp-server1.0	18.04	`1.14.1-1~ubuntu18.04.1`	vulnerable
Ubuntu	gst-rtsp-server1.0	18.04	`1.14.4-1~ubuntu18.04.1`	vulnerable
Ubuntu	gst-rtsp-server1.0	18.04	`1.14.5-0ubuntu1~18.04.1`	vulnerable
Suse	gstreamer-rtsp-server	package hub 15 sp1	`1.12.5-bp151.4.3.1`	fixed
Opensuse	gstreamer-rtsp-server	leap 15.1	`1.12.5-bp151.4.3.1`	fixed
Opensuse	gstreamer-rtsp-server	tumbleweed	`1.18.5-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	gst-rtsp-server1.0	source	sid	`1.16.2-3`	low	Not reported	Not reported
Debian	gst-rtsp-server1.0	source	forky	`1.16.2-3`	low	Not reported	Not reported
Debian	gst-rtsp-server1.0	source	trixie	`1.16.2-3`	low	Not reported	Not reported
Debian	gst-rtsp-server1.0	source	bookworm	`1.16.2-3`	low	Not reported	Not reported
Suse	gstreamer-rtsp-server	rpm	package hub 15 sp1	`1.12.5-bp151.4.3.1`	Not reported	OPENSUSE-SU-2020:0535-1	Not reported
Opensuse	gstreamer-rtsp-server	rpm	leap 15.1	`1.12.5-bp151.4.3.1`	Not reported	OPENSUSE-SU-2020:0535-1	Not reported
Opensuse	gstreamer-rtsp-server	rpm	tumbleweed	`1.18.5-1.1`	Not reported	OPENSUSE-SU-2024:10831-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[gstreamer-rtsp-server-devel]Unknown
Source package: [gstreamer-rtsp-server]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.18.5-1.1
  Version impact unknown
  dsa · gstreamer-rtsp-server · opensuse · tumbleweed
[libgstrtspserver-1_0-0]Unknown
Source package: [gstreamer-rtsp-server]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.18.5-1.1
  Version impact unknown
  dsa · gstreamer-rtsp-server · opensuse · tumbleweed
[typelib-1_0-GstRtspServer-1_0]Unknown
Source package: [gstreamer-rtsp-server]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.18.5-1.1
  Version impact unknown
  dsa · gstreamer-rtsp-server · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[gir1.2-gst-rtsp-server-1.0]Fixed
Source package: [gst-rtsp-server1.0]
Details (2)
- 1.22.0-2 · amd64 · bookworm
  Fixed · Fixed: 1.16.2-3
  dsa · gst-rtsp-server1.0 · debian · bookworm; dsa · gst-rtsp-server1.0 · debian · 12
- 1.22.0-2 · arm64 · bookworm
  Fixed · Fixed: 1.16.2-3
  dsa · gst-rtsp-server1.0 · debian · bookworm; dsa · gst-rtsp-server1.0 · debian · 12
[gstreamer1.0-rtsp]Fixed
Source package: [gst-rtsp-server1.0]
Details (2)
- 1.22.0-2 · amd64 · bookworm
  Fixed · Fixed: 1.16.2-3
  dsa · gst-rtsp-server1.0 · debian · bookworm; dsa · gst-rtsp-server1.0 · debian · 12
- 1.22.0-2 · arm64 · bookworm
  Fixed · Fixed: 1.16.2-3
  dsa · gst-rtsp-server1.0 · debian · bookworm; dsa · gst-rtsp-server1.0 · debian · 12
[libgstrtspserver-1.0-0]Fixed
Source package: [gst-rtsp-server1.0]
Details (2)
- 1.22.0-2 · amd64 · bookworm
  Fixed · Fixed: 1.16.2-3
  dsa · gst-rtsp-server1.0 · debian · bookworm; dsa · gst-rtsp-server1.0 · debian · 12
- 1.22.0-2 · arm64 · bookworm
  Fixed · Fixed: 1.16.2-3
  dsa · gst-rtsp-server1.0 · debian · bookworm; dsa · gst-rtsp-server1.0 · debian · 12
[libgstrtspserver-1.0-dev]Fixed
Source package: [gst-rtsp-server1.0]
Details (2)
- 1.22.0-2 · amd64 · bookworm
  Fixed · Fixed: 1.16.2-3
  dsa · gst-rtsp-server1.0 · debian · bookworm; dsa · gst-rtsp-server1.0 · debian · 12
- 1.22.0-2 · arm64 · bookworm
  Fixed · Fixed: 1.16.2-3
  dsa · gst-rtsp-server1.0 · debian · bookworm; dsa · gst-rtsp-server1.0 · debian · 12

[Debian 13 (Trixie)]

[gir1.2-gst-rtsp-server-1.0]Fixed
Source package: [gst-rtsp-server1.0]
Details (2)
- 1.26.2-1 · amd64 · trixie
  Fixed · Fixed: 1.16.2-3
  dsa · gst-rtsp-server1.0 · debian · 13
- 1.26.2-1 · arm64 · trixie
  Fixed · Fixed: 1.16.2-3
  dsa · gst-rtsp-server1.0 · debian · 13
[gstreamer1.0-rtsp]Fixed
Source package: [gst-rtsp-server1.0]
Details (2)
- 1.26.2-1 · amd64 · trixie
  Fixed · Fixed: 1.16.2-3
  dsa · gst-rtsp-server1.0 · debian · 13
- 1.26.2-1 · arm64 · trixie
  Fixed · Fixed: 1.16.2-3
  dsa · gst-rtsp-server1.0 · debian · 13
[libgstrtspserver-1.0-0]Fixed
Source package: [gst-rtsp-server1.0]
Details (2)
- 1.26.2-1 · amd64 · trixie
  Fixed · Fixed: 1.16.2-3
  dsa · gst-rtsp-server1.0 · debian · 13
- 1.26.2-1 · arm64 · trixie
  Fixed · Fixed: 1.16.2-3
  dsa · gst-rtsp-server1.0 · debian · 13
[libgstrtspserver-1.0-dev]Fixed
Source package: [gst-rtsp-server1.0]
Details (2)
- 1.26.2-1 · amd64 · trixie
  Fixed · Fixed: 1.16.2-3
  dsa · gst-rtsp-server1.0 · debian · 13
- 1.26.2-1 · arm64 · trixie
  Fixed · Fixed: 1.16.2-3
  dsa · gst-rtsp-server1.0 · debian · 13

Observed: Oct 23, 2026, 5:52:54 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]