vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2020-1752

HIGH
7
CVSS Score
Published: April 30, 2020 at 12:00 AM UTC
Updated: October 14, 2026 at 09:17 AM UTC
9 products affected across 5 vendorsDebian LinuxUbuntu LinuxActive IQ Unified Manager· also runs on 1 platform

Using glibc by GNU Libc?

Get instant alerts when new vulnerabilities affect glibc - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7
Exploit prediction
EPSS 0.5%

Description

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ubuntu Linux· Canonicalrubygems
95%
16.0418.0419.10
Debian Linux· Debiandrupal
95%
10.0
Glibc· Gnu
95%
v < 2.32.0
Affected range stops below 2.32.0, so it looks safe — our inference, not a vendor statement
Active IQ Unified Manager· NetAppnpm
95%
v ≥ 9.5
H410C Firmware· NetAppdrupal
95%
All versions
netapp-h410c (same device)
Hci Management Node· NetApp
95%
All versions
Solidfire· NetApp
95%
All versions
Steelstore Cloud Integrated Storage· NetApp
95%
All versions
Glibc· Gnu Libc
90%
Fixed: version 2.32

Runs on — not affected

The affected product only carries this flaw when running on these platforms. The platforms themselves are not vulnerable.

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (11)

Issue TrackingPatchThird Party Advisory
Source: [email protected]
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1752
Mailing List
Source: [email protected]
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
Mailing List
Source: [email protected]
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
Mailing ListThird Party Advisory
Source: [email protected]
https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
Vendor AdvisoryThird Party Advisory
Source: [email protected]
https://security.gentoo.org/glsa/202101-20
Third Party Advisory
Source: [email protected]
https://security.netapp.com/advisory/ntap-20200511-0005/
Issue TrackingPatchThird Party Advisory
Source: [email protected]
https://sourceware.org/bugzilla/show_bug.cgi?id=25414
Source: [email protected]
https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ddc650e9b3dc916eab417ce9f79e67337b05035c

CVSS

7HIGHredhat
Attack Vector
LOCAL
Complexity
HIGH
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-416

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card