Action not permitted
Modal body text goes here.
Modal Title
Modal Body
Vulnerability from csaf_ncscnl
Published
2025-01-22 13:31
Modified
2025-01-22 13:31
Summary
Kwetsbaarheden verholpen in Oracle PeopleSoft
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Oracle heeft meerdere kwetsbaarheden verholpen in Oracle PeopleSoft, specifiek in de versies 8.60, 8.61 en 9.2.
Interpretaties
De kwetsbaarheden in Oracle PeopleSoft stellen geauthenticeerde kwaadwillenden in staat om via HTTP-netwerktoegang ongeautoriseerde toegang te krijgen tot specifieke gegevens, wat kan leiden tot ongeautoriseerde gegevensmanipulatie en -toegang. Kwaadwillenden kunnen ook een Denial-of-Service veroorzaken. Hiervoor heeft de kwaadwillende geen voorafgaande authenticatie nodig.
Oplossingen
Oracle heeft updates uitgebracht om de kwetsbaarheden in PeopleSoft te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-670
Always-Incorrect Control Flow Implementation
CWE-1395
Dependency on Vulnerable Third-Party Component
CWE-669
Incorrect Resource Transfer Between Spheres
CWE-126
Buffer Over-read
CWE-125
Out-of-bounds Read
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-400
Uncontrolled Resource Consumption
CWE-770
Allocation of Resources Without Limits or Throttling
CWE-787
Out-of-bounds Write
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
{ document: { category: "csaf_security_advisory", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", }, }, lang: "nl", notes: [ { category: "legal_disclaimer", text: "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.", }, { category: "description", text: "Oracle heeft meerdere kwetsbaarheden verholpen in Oracle PeopleSoft, specifiek in de versies 8.60, 8.61 en 9.2.", title: "Feiten", }, { category: "description", text: "De kwetsbaarheden in Oracle PeopleSoft stellen geauthenticeerde kwaadwillenden in staat om via HTTP-netwerktoegang ongeautoriseerde toegang te krijgen tot specifieke gegevens, wat kan leiden tot ongeautoriseerde gegevensmanipulatie en -toegang. Kwaadwillenden kunnen ook een Denial-of-Service veroorzaken. Hiervoor heeft de kwaadwillende geen voorafgaande authenticatie nodig.", title: "Interpretaties", }, { category: "description", text: "Oracle heeft updates uitgebracht om de kwetsbaarheden in PeopleSoft te verhelpen. Zie bijgevoegde referenties voor meer informatie.", title: "Oplossingen", }, { category: "general", text: "medium", title: "Kans", }, { category: "general", text: "high", title: "Schade", }, { category: "general", text: "Always-Incorrect Control Flow Implementation", title: "CWE-670", }, { category: "general", text: "Dependency on Vulnerable Third-Party Component", title: "CWE-1395", }, { category: "general", text: "Incorrect Resource Transfer Between Spheres", title: "CWE-669", }, { category: "general", text: "Buffer Over-read", title: "CWE-126", }, { category: "general", text: "Out-of-bounds Read", title: "CWE-125", }, { category: "general", text: "Improper Restriction of Operations within the Bounds of a Memory Buffer", title: "CWE-119", }, { category: "general", text: "Uncontrolled Resource Consumption", title: "CWE-400", }, { category: "general", text: "Allocation of Resources Without Limits or Throttling", title: "CWE-770", }, { category: "general", text: "Out-of-bounds Write", title: "CWE-787", }, { category: "general", text: "Exposure of Sensitive Information to an Unauthorized Actor", title: "CWE-200", }, { category: "general", text: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", title: "CWE-120", }, ], publisher: { category: "coordinator", contact_details: "cert@ncsc.nl", name: "Nationaal Cyber Security Centrum", namespace: "https://www.ncsc.nl/", }, references: [ { category: "external", summary: "Reference - cveprojectv5; nvd; oracle", url: "https://www.oracle.com/security-alerts/cpujan2025.html", }, ], title: "Kwetsbaarheden verholpen in Oracle PeopleSoft", tracking: { current_release_date: "2025-01-22T13:31:17.380797Z", id: "NCSC-2025-0023", initial_release_date: "2025-01-22T13:31:17.380797Z", revision_history: [ { date: "2025-01-22T13:31:17.380797Z", number: "0", summary: "Initiele versie", }, ], status: "final", version: "1.0.0", }, }, product_tree: { branches: [ { branches: [ { category: "product_name", name: "peoplesoft_enterprise_cc_common_application_objects", product: { name: "peoplesoft_enterprise_cc_common_application_objects", product_id: "CSAFPID-449779", product_identification_helper: { cpe: "cpe:2.3:a:oracle:peoplesoft_enterprise_cc_common_application_objects:9.2:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "peoplesoft_enterprise_fin_cash_management", product: { name: "peoplesoft_enterprise_fin_cash_management", product_id: "CSAFPID-765405", product_identification_helper: { cpe: "cpe:2.3:a:oracle:peoplesoft_enterprise_fin_cash_management:9.2:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "peoplesoft_enterprise_fin_esettlements", product: { name: "peoplesoft_enterprise_fin_esettlements", product_id: "CSAFPID-1751153", product_identification_helper: { cpe: "cpe:2.3:a:oracle:peoplesoft_enterprise_fin_esettlements:9.2:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "peoplesoft_enterprise_hcm_human_resources", product: { name: "peoplesoft_enterprise_hcm_human_resources", product_id: "CSAFPID-172663", product_identification_helper: { cpe: "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_human_resources:9.2:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "peoplesoft_enterprise_hcm_shared_components", product: { name: "peoplesoft_enterprise_hcm_shared_components", product_id: "CSAFPID-607590", product_identification_helper: { cpe: "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_shared_components:9.2:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "peoplesoft_enterprise_peopletools", product: { name: "peoplesoft_enterprise_peopletools", product_id: "CSAFPID-1682", product_identification_helper: { cpe: "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "peoplesoft_enterprise_peopletools", product: { name: "peoplesoft_enterprise_peopletools", product_id: "CSAFPID-1681", product_identification_helper: { cpe: "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.60:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "peoplesoft_enterprise_peopletools", product: { name: "peoplesoft_enterprise_peopletools", product_id: "CSAFPID-816362", product_identification_helper: { cpe: "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "peoplesoft_enterprise_peopletools", product: { name: "peoplesoft_enterprise_peopletools", product_id: "CSAFPID-1503667", product_identification_helper: { cpe: "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_opensearch___8.59:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "peoplesoft_enterprise_peopletools", product: { name: "peoplesoft_enterprise_peopletools", product_id: "CSAFPID-1503672", product_identification_helper: { cpe: "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_opensearch___8.60:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "peoplesoft_enterprise_peopletools", product: { name: "peoplesoft_enterprise_peopletools", product_id: "CSAFPID-1503676", product_identification_helper: { cpe: "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_opensearch___8.61:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "peoplesoft_enterprise_peopletools", product: { name: "peoplesoft_enterprise_peopletools", product_id: "CSAFPID-1503669", product_identification_helper: { cpe: "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_web_server___8.59:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "peoplesoft_enterprise_peopletools", product: { name: "peoplesoft_enterprise_peopletools", product_id: "CSAFPID-1503673", product_identification_helper: { cpe: "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_web_server___8.60:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "peoplesoft_enterprise_peopletools", product: { name: "peoplesoft_enterprise_peopletools", product_id: "CSAFPID-1503678", product_identification_helper: { cpe: "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_web_server___8.61:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "peoplesoft_enterprise_scm_purchasing", product: { name: "peoplesoft_enterprise_scm_purchasing", product_id: "CSAFPID-172660", product_identification_helper: { cpe: "cpe:2.3:a:oracle:peoplesoft_enterprise_scm_purchasing:9.2:*:*:*:*:*:*:*", }, }, }, ], category: "vendor", name: "oracle", }, ], }, vulnerabilities: [ { cve: "CVE-2020-22218", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, notes: [ { category: "other", text: "Out-of-bounds Read", title: "CWE-125", }, { category: "other", text: "Out-of-bounds Write", title: "CWE-787", }, ], product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2020-22218", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-22218.json", }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2020-22218", }, { cve: "CVE-2023-48795", cwe: { id: "CWE-222", name: "Truncation of Security-relevant Information", }, notes: [ { category: "other", text: "Truncation of Security-relevant Information", title: "CWE-222", }, { category: "other", text: "Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')", title: "CWE-757", }, { category: "other", text: "Improper Validation of Integrity Check Value", title: "CWE-354", }, ], product_status: { known_affected: [ "CSAFPID-1682", "CSAFPID-1681", "CSAFPID-816362", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1503676", "CSAFPID-1503678", ], }, references: [ { category: "self", summary: "CVE-2023-48795", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-48795.json", }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "CSAFPID-1682", "CSAFPID-1681", "CSAFPID-816362", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1503676", "CSAFPID-1503678", ], }, ], title: "CVE-2023-48795", }, { cve: "CVE-2024-0397", product_status: { known_affected: [ "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362", ], }, references: [ { category: "self", summary: "CVE-2024-0397", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0397.json", }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362", ], }, ], title: "CVE-2024-0397", }, { cve: "CVE-2024-2511", cwe: { id: "CWE-404", name: "Improper Resource Shutdown or Release", }, notes: [ { category: "other", text: "Improper Resource Shutdown or Release", title: "CWE-404", }, { category: "other", text: "Uncontrolled Resource Consumption", title: "CWE-400", }, { category: "other", text: "Improperly Controlled Sequential Memory Allocation", title: "CWE-1325", }, ], product_status: { known_affected: [ "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362", ], }, references: [ { category: "self", summary: "CVE-2024-2511", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-2511.json", }, ], scores: [ { cvss_v3: { baseScore: 9.1, baseSeverity: "CRITICAL", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", version: "3.1", }, products: [ "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362", ], }, ], title: "CVE-2024-2511", }, { cve: "CVE-2024-4030", cwe: { id: "CWE-276", name: "Incorrect Default Permissions", }, notes: [ { category: "other", text: "Incorrect Default Permissions", title: "CWE-276", }, ], product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2024-4030", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-4030.json", }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2024-4030", }, { cve: "CVE-2024-4032", cwe: { id: "CWE-440", name: "Expected Behavior Violation", }, notes: [ { category: "other", text: "Expected Behavior Violation", title: "CWE-440", }, ], product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2024-4032", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-4032.json", }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2024-4032", }, { cve: "CVE-2024-4603", cwe: { id: "CWE-606", name: "Unchecked Input for Loop Condition", }, notes: [ { category: "other", text: "Unchecked Input for Loop Condition", title: "CWE-606", }, { category: "other", text: "Excessive Iteration", title: "CWE-834", }, ], product_status: { known_affected: [ "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362", ], }, references: [ { category: "self", summary: "CVE-2024-4603", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-4603.json", }, ], scores: [ { cvss_v3: { baseScore: 9.1, baseSeverity: "CRITICAL", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", version: "3.1", }, products: [ "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362", ], }, ], title: "CVE-2024-4603", }, { cve: "CVE-2024-4741", cwe: { id: "CWE-416", name: "Use After Free", }, notes: [ { category: "other", text: "Use After Free", title: "CWE-416", }, ], product_status: { known_affected: [ "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362", ], }, references: [ { category: "self", summary: "CVE-2024-4741", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-4741.json", }, ], title: "CVE-2024-4741", }, { cve: "CVE-2024-5535", cwe: { id: "CWE-200", name: "Exposure of Sensitive Information to an Unauthorized Actor", }, notes: [ { category: "other", text: "Exposure of Sensitive Information to an Unauthorized Actor", title: "CWE-200", }, { category: "other", text: "Improper Restriction of Operations within the Bounds of a Memory Buffer", title: "CWE-119", }, { category: "other", text: "Dependency on Vulnerable Third-Party Component", title: "CWE-1395", }, ], product_status: { known_affected: [ "CSAFPID-1681", "CSAFPID-816362", ], }, references: [ { category: "self", summary: "CVE-2024-5535", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-5535.json", }, ], scores: [ { cvss_v3: { baseScore: 9.1, baseSeverity: "CRITICAL", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", version: "3.1", }, products: [ "CSAFPID-1681", "CSAFPID-816362", ], }, ], title: "CVE-2024-5535", }, { cve: "CVE-2024-6119", cwe: { id: "CWE-843", name: "Access of Resource Using Incompatible Type ('Type Confusion')", }, notes: [ { category: "other", text: "Access of Resource Using Incompatible Type ('Type Confusion')", title: "CWE-843", }, ], product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2024-6119", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-6119.json", }, ], scores: [ { cvss_v3: { baseScore: 9.1, baseSeverity: "CRITICAL", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2024-6119", }, { cve: "CVE-2024-6232", cwe: { id: "CWE-1333", name: "Inefficient Regular Expression Complexity", }, notes: [ { category: "other", text: "Inefficient Regular Expression Complexity", title: "CWE-1333", }, ], product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2024-6232", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-6232.json", }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2024-6232", }, { cve: "CVE-2024-7592", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, notes: [ { category: "other", text: "Uncontrolled Resource Consumption", title: "CWE-400", }, ], product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2024-7592", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-7592.json", }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2024-7592", }, { cve: "CVE-2024-22018", cwe: { id: "CWE-275", name: "-", }, notes: [ { category: "other", text: "CWE-275", title: "CWE-275", }, ], product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2024-22018", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22018.json", }, ], scores: [ { cvss_v3: { baseScore: 7.1, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2024-22018", }, { cve: "CVE-2024-22019", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, notes: [ { category: "other", text: "Uncontrolled Resource Consumption", title: "CWE-400", }, { category: "other", text: "Improper Resource Shutdown or Release", title: "CWE-404", }, ], product_status: { known_affected: [ "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-816362", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1503676", "CSAFPID-1503678", ], }, references: [ { category: "self", summary: "CVE-2024-22019", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22019.json", }, ], scores: [ { cvss_v3: { baseScore: 8.2, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", version: "3.1", }, products: [ "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-816362", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1503676", "CSAFPID-1503678", ], }, ], title: "CVE-2024-22019", }, { cve: "CVE-2024-22020", product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2024-22020", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22020.json", }, ], scores: [ { cvss_v3: { baseScore: 8.2, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2024-22020", }, { cve: "CVE-2024-27280", cwe: { id: "CWE-120", name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", }, notes: [ { category: "other", text: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", title: "CWE-120", }, { category: "other", text: "Buffer Over-read", title: "CWE-126", }, ], product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2024-27280", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-27280.json", }, ], scores: [ { cvss_v3: { baseScore: 9.8, baseSeverity: "CRITICAL", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2024-27280", }, { cve: "CVE-2024-27281", cwe: { id: "CWE-94", name: "Improper Control of Generation of Code ('Code Injection')", }, notes: [ { category: "other", text: "Improper Control of Generation of Code ('Code Injection')", title: "CWE-94", }, { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, { category: "other", text: "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", title: "CWE-74", }, ], product_status: { known_affected: [ "CSAFPID-1681", "CSAFPID-816362", ], }, references: [ { category: "self", summary: "CVE-2024-27281", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-27281.json", }, ], title: "CVE-2024-27281", }, { cve: "CVE-2024-27282", cwe: { id: "CWE-122", name: "Heap-based Buffer Overflow", }, notes: [ { category: "other", text: "Heap-based Buffer Overflow", title: "CWE-122", }, { category: "other", text: "Out-of-bounds Read", title: "CWE-125", }, ], product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2024-27282", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-27282.json", }, ], scores: [ { cvss_v3: { baseScore: 8.1, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2024-27282", }, { cve: "CVE-2024-28849", cwe: { id: "CWE-200", name: "Exposure of Sensitive Information to an Unauthorized Actor", }, notes: [ { category: "other", text: "Exposure of Sensitive Information to an Unauthorized Actor", title: "CWE-200", }, ], product_status: { known_affected: [ "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362", ], }, references: [ { category: "self", summary: "CVE-2024-28849", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-28849.json", }, ], scores: [ { cvss_v3: { baseScore: 6.5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362", ], }, ], title: "CVE-2024-28849", }, { cve: "CVE-2024-29025", cwe: { id: "CWE-770", name: "Allocation of Resources Without Limits or Throttling", }, notes: [ { category: "other", text: "Allocation of Resources Without Limits or Throttling", title: "CWE-770", }, ], product_status: { known_affected: [ "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362", ], }, references: [ { category: "self", summary: "CVE-2024-29025", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-29025.json", }, ], scores: [ { cvss_v3: { baseScore: 7.3, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", version: "3.1", }, products: [ "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362", ], }, ], title: "CVE-2024-29025", }, { cve: "CVE-2024-35195", cwe: { id: "CWE-670", name: "Always-Incorrect Control Flow Implementation", }, notes: [ { category: "other", text: "Always-Incorrect Control Flow Implementation", title: "CWE-670", }, ], product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2024-35195", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-35195.json", }, ], scores: [ { cvss_v3: { baseScore: 5.7, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2024-35195", }, { cve: "CVE-2024-36137", cwe: { id: "CWE-275", name: "-", }, notes: [ { category: "other", text: "CWE-275", title: "CWE-275", }, { category: "other", text: "Incorrect Permission Assignment for Critical Resource", title: "CWE-732", }, ], product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2024-36137", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-36137.json", }, ], scores: [ { cvss_v3: { baseScore: 7.1, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2024-36137", }, { cve: "CVE-2024-36138", cwe: { id: "CWE-77", name: "Improper Neutralization of Special Elements used in a Command ('Command Injection')", }, notes: [ { category: "other", text: "Improper Neutralization of Special Elements used in a Command ('Command Injection')", title: "CWE-77", }, ], product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2024-36138", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-36138.json", }, ], scores: [ { cvss_v3: { baseScore: 10, baseSeverity: "CRITICAL", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2024-36138", }, { cve: "CVE-2024-37372", cwe: { id: "CWE-22", name: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", }, notes: [ { category: "other", text: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", title: "CWE-22", }, { category: "other", text: "Improper Check for Unusual or Exceptional Conditions", title: "CWE-754", }, ], product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2024-37372", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-37372.json", }, ], scores: [ { cvss_v3: { baseScore: 7.1, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2024-37372", }, { cve: "CVE-2024-37891", cwe: { id: "CWE-669", name: "Incorrect Resource Transfer Between Spheres", }, notes: [ { category: "other", text: "Incorrect Resource Transfer Between Spheres", title: "CWE-669", }, ], product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2024-37891", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-37891.json", }, ], scores: [ { cvss_v3: { baseScore: 4.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2024-37891", }, { cve: "CVE-2024-38998", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, notes: [ { category: "other", text: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", title: "CWE-1321", }, ], product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2024-38998", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38998.json", }, ], scores: [ { cvss_v3: { baseScore: 9.8, baseSeverity: "CRITICAL", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2024-38998", }, { cve: "CVE-2024-38999", cwe: { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, notes: [ { category: "other", text: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", title: "CWE-1321", }, ], product_status: { known_affected: [ "CSAFPID-816362", "CSAFPID-1681", ], }, references: [ { category: "self", summary: "CVE-2024-38999", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38999.json", }, ], scores: [ { cvss_v3: { baseScore: 10, baseSeverity: "CRITICAL", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "CSAFPID-816362", "CSAFPID-1681", ], }, ], title: "CVE-2024-38999", }, { cve: "CVE-2025-21530", product_status: { known_affected: [ "CSAFPID-1681", "CSAFPID-816362", ], }, references: [ { category: "self", summary: "CVE-2025-21530", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21530.json", }, ], scores: [ { cvss_v3: { baseScore: 4.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, products: [ "CSAFPID-1681", "CSAFPID-816362", ], }, ], title: "CVE-2025-21530", }, { cve: "CVE-2025-21537", product_status: { known_affected: [ "CSAFPID-765405", ], }, references: [ { category: "self", summary: "CVE-2025-21537", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21537.json", }, ], scores: [ { cvss_v3: { baseScore: 5.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", version: "3.1", }, products: [ "CSAFPID-765405", ], }, ], title: "CVE-2025-21537", }, { cve: "CVE-2025-21539", product_status: { known_affected: [ "CSAFPID-1751153", ], }, references: [ { category: "self", summary: "CVE-2025-21539", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21539.json", }, ], scores: [ { cvss_v3: { baseScore: 5.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", version: "3.1", }, products: [ "CSAFPID-1751153", ], }, ], title: "CVE-2025-21539", }, { cve: "CVE-2025-21545", product_status: { known_affected: [ "CSAFPID-1681", "CSAFPID-816362", ], }, references: [ { category: "self", summary: "CVE-2025-21545", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21545.json", }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "CSAFPID-1681", "CSAFPID-816362", ], }, ], title: "CVE-2025-21545", }, { cve: "CVE-2025-21561", product_status: { known_affected: [ "CSAFPID-172660", ], }, references: [ { category: "self", summary: "CVE-2025-21561", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21561.json", }, ], scores: [ { cvss_v3: { baseScore: 5.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", version: "3.1", }, products: [ "CSAFPID-172660", ], }, ], title: "CVE-2025-21561", }, { cve: "CVE-2025-21562", product_status: { known_affected: [ "CSAFPID-449779", ], }, references: [ { category: "self", summary: "CVE-2025-21562", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21562.json", }, ], scores: [ { cvss_v3: { baseScore: 4.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, products: [ "CSAFPID-449779", ], }, ], title: "CVE-2025-21562", }, { cve: "CVE-2025-21563", product_status: { known_affected: [ "CSAFPID-449779", ], }, references: [ { category: "self", summary: "CVE-2025-21563", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21563.json", }, ], scores: [ { cvss_v3: { baseScore: 4.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", version: "3.1", }, products: [ "CSAFPID-449779", ], }, ], title: "CVE-2025-21563", }, ], }
cve-2024-4741
Vulnerability from cvelistv5
Published
2024-11-13 10:20
Modified
2024-11-13 14:49
Severity ?
EPSS score ?
Summary
Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause
memory to be accessed that was previously freed in some situations
Impact summary: A use after free can have a range of potential consequences such
as the corruption of valid data, crashes or execution of arbitrary code.
However, only applications that directly call the SSL_free_buffers function are
affected by this issue. Applications that do not call this function are not
vulnerable. Our investigations indicate that this function is rarely used by
applications.
The SSL_free_buffers function is used to free the internal OpenSSL buffer used
when processing an incoming record from the network. The call is only expected
to succeed if the buffer is not currently in use. However, two scenarios have
been identified where the buffer is freed even when still in use.
The first scenario occurs where a record header has been received from the
network and processed by OpenSSL, but the full record body has not yet arrived.
In this case calling SSL_free_buffers will succeed even though a record has only
been partially processed and the buffer is still in use.
The second scenario occurs where a full record containing application data has
been received and processed by OpenSSL but the application has only read part of
this data. Again a call to SSL_free_buffers will succeed even though the buffer
is still in use.
While these scenarios could occur accidentally during normal operation a
malicious attacker could attempt to engineer a stituation where this occurs.
We are not aware of this issue being actively exploited.
The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
References
Impacted products
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:openssl:openssl:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "openssl", vendor: "openssl", versions: [ { lessThan: "1.1.1y", status: "affected", version: "1.1.1", versionType: "semver", }, { lessThan: "3.0.14", status: "affected", version: "3.0.0", versionType: "semver", }, { lessThan: "3.1.6", status: "affected", version: "3.1.0", versionType: "semver", }, { lessThan: "3.2.2", status: "affected", version: "3.2.0", versionType: "semver", }, { lessThan: "3.3.1", status: "affected", version: "3.3.0", versionType: "semver", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2024-4741", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-11-13T14:45:07.092438Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-11-13T14:49:05.977Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "OpenSSL", vendor: "OpenSSL", versions: [ { lessThan: "3.3.1", status: "affected", version: "3.3.0", versionType: "semver", }, { lessThan: "3.2.2", status: "affected", version: "3.2.0", versionType: "semver", }, { lessThan: "3.1.6", status: "affected", version: "3.1.0", versionType: "semver", }, { lessThan: "3.0.14", status: "affected", version: "3.0.0", versionType: "semver", }, { lessThan: "1.1.1y", status: "affected", version: "1.1.1", versionType: "custom", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "William Ahern (Akamai)", }, { lang: "en", type: "remediation developer", value: "Matt Caswell", }, { lang: "en", type: "remediation developer", value: "Watson Ladd (Akamai)", }, ], datePublic: "2024-05-27T23:00:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause<br>memory to be accessed that was previously freed in some situations<br><br>Impact summary: A use after free can have a range of potential consequences such<br>as the corruption of valid data, crashes or execution of arbitrary code.<br>However, only applications that directly call the SSL_free_buffers function are<br>affected by this issue. Applications that do not call this function are not<br>vulnerable. Our investigations indicate that this function is rarely used by<br>applications.<br><br>The SSL_free_buffers function is used to free the internal OpenSSL buffer used<br>when processing an incoming record from the network. The call is only expected<br>to succeed if the buffer is not currently in use. However, two scenarios have<br>been identified where the buffer is freed even when still in use.<br><br>The first scenario occurs where a record header has been received from the<br>network and processed by OpenSSL, but the full record body has not yet arrived.<br>In this case calling SSL_free_buffers will succeed even though a record has only<br>been partially processed and the buffer is still in use.<br><br>The second scenario occurs where a full record containing application data has<br>been received and processed by OpenSSL but the application has only read part of<br>this data. Again a call to SSL_free_buffers will succeed even though the buffer<br>is still in use.<br><br>While these scenarios could occur accidentally during normal operation a<br>malicious attacker could attempt to engineer a stituation where this occurs.<br>We are not aware of this issue being actively exploited.<br><br>The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.", }, ], value: "Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.", }, ], metrics: [ { format: "other", other: { content: { text: "Low", }, type: "https://www.openssl.org/policies/secpolicy.html", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-416", description: "CWE-416 Use After Free", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-11-13T10:20:50.711Z", orgId: "3a12439a-ef3a-4c79-92e6-6081a721f1e5", shortName: "openssl", }, references: [ { name: "OpenSSL Advisory", tags: [ "vendor-advisory", ], url: "https://www.openssl.org/news/secadv/20240528.txt", }, { name: "3.3.1 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8", }, { name: "3.2.2 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac", }, { name: "3.1.6 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177", }, { name: "3.0.14 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d", }, { name: "1.1.1y git commit", tags: [ "patch", ], url: "https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4", }, ], source: { discovery: "UNKNOWN", }, title: "Use After Free with SSL_free_buffers", x_generator: { engine: "Vulnogram 0.2.0", }, }, }, cveMetadata: { assignerOrgId: "3a12439a-ef3a-4c79-92e6-6081a721f1e5", assignerShortName: "openssl", cveId: "CVE-2024-4741", datePublished: "2024-11-13T10:20:50.711Z", dateReserved: "2024-05-10T09:56:11.310Z", dateUpdated: "2024-11-13T14:49:05.977Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-27282
Vulnerability from cvelistv5
Published
2024-05-08 20:40
Modified
2025-02-13 15:47
Severity ?
EPSS score ?
Summary
An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.
References
{ containers: { adp: [ { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "LOW", baseScore: 6.6, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L", version: "3.1", }, }, { other: { content: { id: "CVE-2024-27282", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-07-23T18:26:58.094183Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-125", description: "CWE-125 Out-of-bounds Read", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-11-01T18:30:11.472Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-10-11T22:03:13.152Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://hackerone.com/reports/2122624", }, { tags: [ "x_transferred", ], url: "https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/", }, { url: "https://security.netapp.com/advisory/ntap-20241011-0007/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], descriptions: [ { lang: "en", value: "An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2024-05-08T20:40:42.400Z", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { url: "https://hackerone.com/reports/2122624", }, { url: "https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/", }, ], }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2024-27282", datePublished: "2024-05-08T20:40:42.040Z", dateReserved: "2024-02-22T00:00:00.000Z", dateUpdated: "2025-02-13T15:47:16.338Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2025-21539
Vulnerability from cvelistv5
Published
2025-01-21 20:53
Modified
2025-01-22 18:23
Severity ?
EPSS score ?
Summary
Vulnerability in the PeopleSoft Enterprise FIN eSettlements product of Oracle PeopleSoft (component: eSettlements). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN eSettlements. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN eSettlements accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN eSettlements accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
References
â–Ľ | URL | Tags |
---|---|---|
https://www.oracle.com/security-alerts/cpujan2025.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Oracle Corporation | PeopleSoft Enterprise FIN eSettlements |
Version: 9.2 cpe:2.3:a:oracle:peoplesoft_enterprise_fin_esettlements:9.2:*:*:*:*:*:*:* |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2025-21539", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2025-01-22T18:23:14.320503Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-863", description: "CWE-863 Incorrect Authorization", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-22T18:23:46.458Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { cpes: [ "cpe:2.3:a:oracle:peoplesoft_enterprise_fin_esettlements:9.2:*:*:*:*:*:*:*", ], product: "PeopleSoft Enterprise FIN eSettlements", vendor: "Oracle Corporation", versions: [ { status: "affected", version: "9.2", }, ], }, ], descriptions: [ { lang: "en-US", value: "Vulnerability in the PeopleSoft Enterprise FIN eSettlements product of Oracle PeopleSoft (component: eSettlements). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN eSettlements. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN eSettlements accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN eSettlements accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { description: "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN eSettlements. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN eSettlements accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN eSettlements accessible data.", lang: "en-US", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-21T20:53:11.916Z", orgId: "43595867-4340-4103-b7a2-9a5208d29a85", shortName: "oracle", }, references: [ { name: "Oracle Advisory", tags: [ "vendor-advisory", ], url: "https://www.oracle.com/security-alerts/cpujan2025.html", }, ], }, }, cveMetadata: { assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85", assignerShortName: "oracle", cveId: "CVE-2025-21539", datePublished: "2025-01-21T20:53:11.916Z", dateReserved: "2024-12-24T23:18:54.773Z", dateUpdated: "2025-01-22T18:23:46.458Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-0397
Vulnerability from cvelistv5
Published
2024-06-17 15:09
Modified
2024-09-17 18:24
Severity ?
EPSS score ?
Summary
A defect was discovered in the Python “ssl” module where there is a memory
race condition with the ssl.SSLContext methods “cert_store_stats()” and
“get_ca_certs()”. The race condition can be triggered if the methods are
called at the same time as certificates are loaded into the SSLContext,
such as during the TLS handshake with a certificate directory configured.
This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Python Software Foundation | CPython |
Version: 0 Version: 3.9.0 Version: 3.10.0 Version: 3.11.0 Version: 3.12.0 Version: 3.13.0a1 |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*", ], defaultStatus: "unaffected", product: "cpython", vendor: "python_software_foundation", versions: [ { lessThan: "3.8.20", status: "affected", version: "0", versionType: "python", }, { lessThan: "3.9.20", status: "affected", version: "3.9.0", versionType: "python", }, { lessThan: "3.10.14", status: "affected", version: "3.10.0", versionType: "python", }, { lessThan: "3.11.9", status: "affected", version: "3.11.0", versionType: "python", }, { lessThan: "3.12.3", status: "affected", version: "3.12.0", versionType: "python", }, { lessThan: "3.13.0a5", status: "affected", version: "3.13.0a1", versionType: "python", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2024-0397", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-06-20T15:52:27.499743Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-362", description: "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-17T18:24:43.948Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-01T18:04:49.771Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "issue-tracking", "x_transferred", ], url: "https://github.com/python/cpython/issues/114572", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/pull/114573", }, { tags: [ "vendor-advisory", "x_transferred", ], url: "https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/06/17/2", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CPython", repo: "https://github.com/python/cpython", vendor: "Python Software Foundation", versions: [ { lessThan: "3.8.20", status: "affected", version: "0", versionType: "python", }, { lessThan: "3.9.20", status: "affected", version: "3.9.0", versionType: "python", }, { lessThan: "3.10.14", status: "affected", version: "3.10.0", versionType: "python", }, { lessThan: "3.11.9", status: "affected", version: "3.11.0", versionType: "python", }, { lessThan: "3.12.3", status: "affected", version: "3.12.0", versionType: "python", }, { lessThan: "3.13.0a5", status: "affected", version: "3.13.0a1", versionType: "python", }, ], }, ], descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.", }, ], value: "A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.", }, ], providerMetadata: { dateUpdated: "2024-09-07T02:44:08.540Z", orgId: "28c92f92-d60d-412d-b760-e73465c3df22", shortName: "PSF", }, references: [ { tags: [ "issue-tracking", ], url: "https://github.com/python/cpython/issues/114572", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/pull/114573", }, { tags: [ "vendor-advisory", ], url: "https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab", }, { url: "http://www.openwall.com/lists/oss-security/2024/06/17/2", }, ], source: { discovery: "UNKNOWN", }, title: "Memory race condition in ssl.SSLContext certificate store methods", x_generator: { engine: "Vulnogram 0.2.0", }, }, }, cveMetadata: { assignerOrgId: "28c92f92-d60d-412d-b760-e73465c3df22", assignerShortName: "PSF", cveId: "CVE-2024-0397", datePublished: "2024-06-17T15:09:40.896Z", dateReserved: "2024-01-10T14:05:31.635Z", dateUpdated: "2024-09-17T18:24:43.948Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2025-21563
Vulnerability from cvelistv5
Published
2025-01-21 20:53
Modified
2025-02-04 18:31
Severity ?
EPSS score ?
Summary
Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
References
â–Ľ | URL | Tags |
---|---|---|
https://www.oracle.com/security-alerts/cpujan2025.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Oracle Corporation | PeopleSoft Enterprise CC Common Application Objects |
Version: 9.2 cpe:2.3:a:oracle:peoplesoft_enterprise_cc_common_application_objects:9.2:*:*:*:*:*:*:* |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2025-21563", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2025-01-22T15:01:03.000082Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-863", description: "CWE-863 Incorrect Authorization", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-02-04T18:31:49.177Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { cpes: [ "cpe:2.3:a:oracle:peoplesoft_enterprise_cc_common_application_objects:9.2:*:*:*:*:*:*:*", ], product: "PeopleSoft Enterprise CC Common Application Objects", vendor: "Oracle Corporation", versions: [ { status: "affected", version: "9.2", }, ], }, ], descriptions: [ { lang: "en-US", value: "Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { description: "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise CC Common Application Objects accessible data.", lang: "en-US", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-21T20:53:21.250Z", orgId: "43595867-4340-4103-b7a2-9a5208d29a85", shortName: "oracle", }, references: [ { name: "Oracle Advisory", tags: [ "vendor-advisory", ], url: "https://www.oracle.com/security-alerts/cpujan2025.html", }, ], }, }, cveMetadata: { assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85", assignerShortName: "oracle", cveId: "CVE-2025-21563", datePublished: "2025-01-21T20:53:21.250Z", dateReserved: "2024-12-24T23:18:54.783Z", dateUpdated: "2025-02-04T18:31:49.177Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-36138
Vulnerability from cvelistv5
Published
2024-09-07 16:00
Modified
2024-11-08 15:02
Severity ?
EPSS score ?
Summary
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.
References
Impacted products
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*", ], defaultStatus: "unaffected", product: "nodejs", vendor: "nodejs", versions: [ { lessThan: "18.20.4", status: "affected", version: "18.0", versionType: "semver", }, { lessThan: "20.15.1", status: "affected", version: "20.0", versionType: "semver", }, { lessThan: "22.4.1", status: "affected", version: "22.0", versionType: "semver", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2024-36138", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-09-09T17:53:28.236286Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-77", description: "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-09T17:57:58.475Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-11-08T15:02:49.727Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { url: "https://security.netapp.com/advisory/ntap-20241108-0010/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "node", vendor: "nodejs", versions: [ { lessThanOrEqual: "18.20.3", status: "affected", version: "18.20.3", versionType: "semver", }, { lessThanOrEqual: "20.15.0", status: "affected", version: "20.15.0", versionType: "semver", }, { lessThanOrEqual: "22.4.0", status: "affected", version: "22.4.0", versionType: "semver", }, ], }, ], descriptions: [ { lang: "en", value: "Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.", }, ], metrics: [ { cvssV3_0: { baseScore: 8.1, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, }, ], providerMetadata: { dateUpdated: "2024-09-07T16:00:36.011Z", orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", shortName: "hackerone", }, references: [ { url: "https://nodejs.org/en/blog/vulnerability/july-2024-security-releases", }, ], }, }, cveMetadata: { assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", assignerShortName: "hackerone", cveId: "CVE-2024-36138", datePublished: "2024-09-07T16:00:36.011Z", dateReserved: "2024-05-21T01:04:07.208Z", dateUpdated: "2024-11-08T15:02:49.727Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2025-21537
Vulnerability from cvelistv5
Published
2025-01-21 20:53
Modified
2025-01-22 18:25
Severity ?
EPSS score ?
Summary
Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Cash Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Cash Management accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Cash Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
References
â–Ľ | URL | Tags |
---|---|---|
https://www.oracle.com/security-alerts/cpujan2025.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Oracle Corporation | PeopleSoft Enterprise FIN Cash Management |
Version: 9.2 cpe:2.3:a:oracle:peoplesoft_enterprise_fin_cash_management:9.2:*:*:*:*:*:*:* |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2025-21537", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2025-01-22T18:24:54.656802Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-863", description: "CWE-863 Incorrect Authorization", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-22T18:25:26.644Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { cpes: [ "cpe:2.3:a:oracle:peoplesoft_enterprise_fin_cash_management:9.2:*:*:*:*:*:*:*", ], product: "PeopleSoft Enterprise FIN Cash Management", vendor: "Oracle Corporation", versions: [ { status: "affected", version: "9.2", }, ], }, ], descriptions: [ { lang: "en-US", value: "Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Cash Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Cash Management accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Cash Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { description: "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Cash Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Cash Management accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Cash Management accessible data.", lang: "en-US", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-21T20:53:11.110Z", orgId: "43595867-4340-4103-b7a2-9a5208d29a85", shortName: "oracle", }, references: [ { name: "Oracle Advisory", tags: [ "vendor-advisory", ], url: "https://www.oracle.com/security-alerts/cpujan2025.html", }, ], }, }, cveMetadata: { assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85", assignerShortName: "oracle", cveId: "CVE-2025-21537", datePublished: "2025-01-21T20:53:11.110Z", dateReserved: "2024-12-24T23:18:54.772Z", dateUpdated: "2025-01-22T18:25:26.644Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2025-21561
Vulnerability from cvelistv5
Published
2025-01-21 20:53
Modified
2025-02-04 16:08
Severity ?
EPSS score ?
Summary
Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Purchasing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM Purchasing accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise SCM Purchasing accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
References
â–Ľ | URL | Tags |
---|---|---|
https://www.oracle.com/security-alerts/cpujan2025.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Oracle Corporation | PeopleSoft Enterprise SCM Purchasing |
Version: 9.2 cpe:2.3:a:oracle:peoplesoft_enterprise_scm_purchasing:9.2:*:*:*:*:*:*:* |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2025-21561", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2025-01-22T16:07:34.993221Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-863", description: "CWE-863 Incorrect Authorization", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-02-04T16:08:38.559Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { cpes: [ "cpe:2.3:a:oracle:peoplesoft_enterprise_scm_purchasing:9.2:*:*:*:*:*:*:*", ], product: "PeopleSoft Enterprise SCM Purchasing", vendor: "Oracle Corporation", versions: [ { status: "affected", version: "9.2", }, ], }, ], descriptions: [ { lang: "en-US", value: "Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Purchasing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM Purchasing accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise SCM Purchasing accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { description: "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Purchasing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM Purchasing accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise SCM Purchasing accessible data.", lang: "en-US", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-21T20:53:20.489Z", orgId: "43595867-4340-4103-b7a2-9a5208d29a85", shortName: "oracle", }, references: [ { name: "Oracle Advisory", tags: [ "vendor-advisory", ], url: "https://www.oracle.com/security-alerts/cpujan2025.html", }, ], }, }, cveMetadata: { assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85", assignerShortName: "oracle", cveId: "CVE-2025-21561", datePublished: "2025-01-21T20:53:20.489Z", dateReserved: "2024-12-24T23:18:54.781Z", dateUpdated: "2025-02-04T16:08:38.559Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-48795
Vulnerability from cvelistv5
Published
2023-12-18 00:00
Modified
2024-08-02 21:46
Severity ?
EPSS score ?
Summary
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T21:46:27.255Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html", }, { tags: [ "x_transferred", ], url: "https://matt.ucc.asn.au/dropbear/CHANGES", }, { tags: [ "x_transferred", ], url: "https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES", }, { tags: [ "x_transferred", ], url: "https://www.netsarang.com/en/xshell-update-history/", }, { tags: [ "x_transferred", ], url: "https://www.paramiko.org/changelog.html", }, { tags: [ "x_transferred", ], url: "https://www.openssh.com/openbsd.html", }, { tags: [ "x_transferred", ], url: "https://github.com/openssh/openssh-portable/commits/master", }, { tags: [ "x_transferred", ], url: "https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ", }, { tags: [ "x_transferred", ], url: "https://www.bitvise.com/ssh-server-version-history", }, { tags: [ "x_transferred", ], url: "https://github.com/ronf/asyncssh/tags", }, { tags: [ "x_transferred", ], url: "https://gitlab.com/libssh/libssh-mirror/-/tags", }, { tags: [ "x_transferred", ], url: "https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/", }, { tags: [ "x_transferred", ], url: "https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42", }, { tags: [ "x_transferred", ], url: "https://www.openssh.com/txt/release-9.6", }, { tags: [ "x_transferred", ], url: "https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/", }, { tags: [ "x_transferred", ], url: "https://www.terrapin-attack.com", }, { tags: [ "x_transferred", ], url: "https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25", }, { tags: [ "x_transferred", ], url: "https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst", }, { tags: [ "x_transferred", ], url: "https://thorntech.com/cve-2023-48795-and-sftp-gateway/", }, { tags: [ "x_transferred", ], url: "https://github.com/warp-tech/russh/releases/tag/v0.40.2", }, { tags: [ "x_transferred", ], url: "https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0", }, { tags: [ "x_transferred", ], url: "https://www.openwall.com/lists/oss-security/2023/12/18/2", }, { tags: [ "x_transferred", ], url: "https://twitter.com/TrueSkrillor/status/1736774389725565005", }, { tags: [ "x_transferred", ], url: "https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d", }, { tags: [ "x_transferred", ], url: "https://github.com/paramiko/paramiko/issues/2337", }, { tags: [ "x_transferred", ], url: "https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg", }, { tags: [ "x_transferred", ], url: "https://news.ycombinator.com/item?id=38684904", }, { tags: [ "x_transferred", ], url: "https://news.ycombinator.com/item?id=38685286", }, { name: "[oss-security] 20231218 CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)", tags: [ "mailing-list", "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2023/12/18/3", }, { tags: [ "x_transferred", ], url: "https://github.com/mwiede/jsch/issues/457", }, { tags: [ "x_transferred", ], url: "https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6", }, { tags: [ "x_transferred", ], url: "https://github.com/erlang/otp/releases/tag/OTP-26.2.1", }, { tags: [ "x_transferred", ], url: "https://github.com/advisories/GHSA-45x7-px36-x8w8", }, { tags: [ "x_transferred", ], url: "https://security-tracker.debian.org/tracker/source-package/libssh2", }, { tags: [ "x_transferred", ], url: "https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg", }, { tags: [ "x_transferred", ], url: "https://security-tracker.debian.org/tracker/CVE-2023-48795", }, { tags: [ "x_transferred", ], url: "https://bugzilla.suse.com/show_bug.cgi?id=1217950", }, { tags: [ "x_transferred", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=2254210", }, { tags: [ "x_transferred", ], url: "https://bugs.gentoo.org/920280", }, { tags: [ "x_transferred", ], url: "https://ubuntu.com/security/CVE-2023-48795", }, { tags: [ "x_transferred", ], url: "https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795/", }, { tags: [ "x_transferred", ], url: "https://access.redhat.com/security/cve/cve-2023-48795", }, { tags: [ "x_transferred", ], url: "https://github.com/mwiede/jsch/pull/461", }, { tags: [ "x_transferred", ], url: "https://github.com/drakkan/sftpgo/releases/tag/v2.5.6", }, { tags: [ "x_transferred", ], url: "https://github.com/libssh2/libssh2/pull/1291", }, { tags: [ "x_transferred", ], url: "https://forum.netgate.com/topic/184941/terrapin-ssh-attack", }, { tags: [ "x_transferred", ], url: "https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5", }, { tags: [ "x_transferred", ], url: "https://github.com/rapier1/hpn-ssh/releases", }, { tags: [ "x_transferred", ], url: "https://github.com/proftpd/proftpd/issues/456", }, { tags: [ "x_transferred", ], url: "https://github.com/TeraTermProject/teraterm/releases/tag/v5.1", }, { tags: [ "x_transferred", ], url: "https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15", }, { tags: [ "x_transferred", ], url: "https://oryx-embedded.com/download/#changelog", }, { tags: [ "x_transferred", ], url: "https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update", }, { tags: [ "x_transferred", ], url: "https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22", }, { tags: [ "x_transferred", ], url: "https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab", }, { tags: [ "x_transferred", ], url: "https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3", }, { tags: [ "x_transferred", ], url: "https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC", }, { tags: [ "x_transferred", ], url: "https://crates.io/crates/thrussh/versions", }, { tags: [ "x_transferred", ], url: "https://github.com/NixOS/nixpkgs/pull/275249", }, { name: "[oss-security] 20231219 Re: CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)", tags: [ "mailing-list", "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2023/12/19/5", }, { tags: [ "x_transferred", ], url: "https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc", }, { tags: [ "x_transferred", ], url: "https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/", }, { name: "[oss-security] 20231220 Re: CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)", tags: [ "mailing-list", "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2023/12/20/3", }, { tags: [ "x_transferred", ], url: "http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html", }, { tags: [ "x_transferred", ], url: "https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES", }, { tags: [ "x_transferred", ], url: "https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES", }, { tags: [ "x_transferred", ], url: "https://github.com/apache/mina-sshd/issues/445", }, { tags: [ "x_transferred", ], url: "https://github.com/hierynomus/sshj/issues/916", }, { tags: [ "x_transferred", ], url: "https://github.com/janmojzis/tinyssh/issues/81", }, { tags: [ "x_transferred", ], url: "https://www.openwall.com/lists/oss-security/2023/12/20/3", }, { tags: [ "x_transferred", ], url: "https://security-tracker.debian.org/tracker/source-package/trilead-ssh2", }, { tags: [ "x_transferred", ], url: "https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16", }, { name: "FEDORA-2023-0733306be9", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/", }, { name: "DSA-5586", tags: [ "vendor-advisory", "x_transferred", ], url: "https://www.debian.org/security/2023/dsa-5586", }, { tags: [ "x_transferred", ], url: "https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508", }, { tags: [ "x_transferred", ], url: "https://www.theregister.com/2023/12/20/terrapin_attack_ssh", }, { tags: [ "x_transferred", ], url: "https://filezilla-project.org/versions.php", }, { tags: [ "x_transferred", ], url: "https://nova.app/releases/#v11.8", }, { tags: [ "x_transferred", ], url: "https://roumenpetrov.info/secsh/#news20231220", }, { tags: [ "x_transferred", ], url: "https://www.vandyke.com/products/securecrt/history.txt", }, { tags: [ "x_transferred", ], url: "https://help.panic.com/releasenotes/transmit5/", }, { tags: [ "x_transferred", ], url: "https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta", }, { tags: [ "x_transferred", ], url: "https://github.com/PowerShell/Win32-OpenSSH/issues/2189", }, { tags: [ "x_transferred", ], url: "https://winscp.net/eng/docs/history#6.2.2", }, { tags: [ "x_transferred", ], url: "https://www.bitvise.com/ssh-client-version-history#933", }, { tags: [ "x_transferred", ], url: "https://github.com/cyd01/KiTTY/issues/520", }, { name: "DSA-5588", tags: [ "vendor-advisory", "x_transferred", ], url: "https://www.debian.org/security/2023/dsa-5588", }, { tags: [ "x_transferred", ], url: "https://github.com/ssh-mitm/ssh-mitm/issues/165", }, { tags: [ "x_transferred", ], url: "https://news.ycombinator.com/item?id=38732005", }, { name: "[debian-lts-announce] 20231226 [SECURITY] [DLA 3694-1] openssh security update", tags: [ "mailing-list", "x_transferred", ], url: "https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html", }, { name: "GLSA-202312-16", tags: [ "vendor-advisory", "x_transferred", ], url: "https://security.gentoo.org/glsa/202312-16", }, { name: "GLSA-202312-17", tags: [ "vendor-advisory", "x_transferred", ], url: "https://security.gentoo.org/glsa/202312-17", }, { name: "FEDORA-2023-20feb865d8", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/", }, { name: "FEDORA-2023-cb8c606fbb", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y/", }, { name: "FEDORA-2023-e77300e4b5", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/", }, { name: "FEDORA-2023-b87ec6cf47", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7/", }, { name: "FEDORA-2023-153404713b", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD/", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240105-0004/", }, { name: "FEDORA-2024-3bb23c77f3", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS/", }, { name: "FEDORA-2023-55800423a8", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/", }, { name: "FEDORA-2024-d946b9ad25", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/", }, { name: "FEDORA-2024-71c2c6526c", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6/", }, { name: "FEDORA-2024-39a8c72ea9", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/", }, { tags: [ "x_transferred", ], url: "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002", }, { name: "FEDORA-2024-ae653fb07b", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/", }, { name: "FEDORA-2024-2705241461", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/", }, { name: "FEDORA-2024-fb32950d11", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/", }, { name: "FEDORA-2024-7b08207cdb", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/", }, { name: "FEDORA-2024-06ebb70bdd", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/", }, { name: "[debian-lts-announce] 20240125 [SECURITY] [DLA 3718-1] php-phpseclib security update", tags: [ "mailing-list", "x_transferred", ], url: "https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html", }, { name: "[debian-lts-announce] 20240125 [SECURITY] [DLA 3719-1] phpseclib security update", tags: [ "mailing-list", "x_transferred", ], url: "https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html", }, { name: "FEDORA-2024-a53b24023d", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/", }, { name: "FEDORA-2024-3fd1bc9276", tags: [ "vendor-advisory", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/", }, { tags: [ "x_transferred", ], url: "https://support.apple.com/kb/HT214084", }, { name: "20240313 APPLE-SA-03-07-2024-2 macOS Sonoma 14.4", tags: [ "mailing-list", "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Mar/21", }, { name: "[debian-lts-announce] 20240425 [SECURITY] [DLA 3794-1] putty security update", tags: [ "mailing-list", "x_transferred", ], url: "https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html", }, { name: "[oss-security] 20240417 Terrapin vulnerability in Jenkins CLI client", tags: [ "mailing-list", "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/04/17/8", }, { name: "[oss-security] 20240306 Multiple vulnerabilities in Jenkins plugins", tags: [ "mailing-list", "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/03/06/3", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], descriptions: [ { lang: "en", value: "The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2024-05-01T18:06:23.972272", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { url: "https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html", }, { url: "https://matt.ucc.asn.au/dropbear/CHANGES", }, { url: "https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES", }, { url: "https://www.netsarang.com/en/xshell-update-history/", }, { url: "https://www.paramiko.org/changelog.html", }, { url: "https://www.openssh.com/openbsd.html", }, { url: "https://github.com/openssh/openssh-portable/commits/master", }, { url: "https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ", }, { url: "https://www.bitvise.com/ssh-server-version-history", }, { url: "https://github.com/ronf/asyncssh/tags", }, { url: "https://gitlab.com/libssh/libssh-mirror/-/tags", }, { url: "https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/", }, { url: "https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42", }, { url: "https://www.openssh.com/txt/release-9.6", }, { url: "https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/", }, { url: "https://www.terrapin-attack.com", }, { url: "https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25", }, { url: "https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst", }, { url: "https://thorntech.com/cve-2023-48795-and-sftp-gateway/", }, { url: "https://github.com/warp-tech/russh/releases/tag/v0.40.2", }, { url: "https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0", }, { url: "https://www.openwall.com/lists/oss-security/2023/12/18/2", }, { url: "https://twitter.com/TrueSkrillor/status/1736774389725565005", }, { url: "https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d", }, { url: "https://github.com/paramiko/paramiko/issues/2337", }, { url: "https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg", }, { url: "https://news.ycombinator.com/item?id=38684904", }, { url: "https://news.ycombinator.com/item?id=38685286", }, { name: "[oss-security] 20231218 CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)", tags: [ "mailing-list", ], url: "http://www.openwall.com/lists/oss-security/2023/12/18/3", }, { url: "https://github.com/mwiede/jsch/issues/457", }, { url: "https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6", }, { url: "https://github.com/erlang/otp/releases/tag/OTP-26.2.1", }, { url: "https://github.com/advisories/GHSA-45x7-px36-x8w8", }, { url: "https://security-tracker.debian.org/tracker/source-package/libssh2", }, { url: "https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg", }, { url: "https://security-tracker.debian.org/tracker/CVE-2023-48795", }, { url: "https://bugzilla.suse.com/show_bug.cgi?id=1217950", }, { url: "https://bugzilla.redhat.com/show_bug.cgi?id=2254210", }, { url: "https://bugs.gentoo.org/920280", }, { url: "https://ubuntu.com/security/CVE-2023-48795", }, { url: "https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795/", }, { url: "https://access.redhat.com/security/cve/cve-2023-48795", }, { url: "https://github.com/mwiede/jsch/pull/461", }, { url: "https://github.com/drakkan/sftpgo/releases/tag/v2.5.6", }, { url: "https://github.com/libssh2/libssh2/pull/1291", }, { url: "https://forum.netgate.com/topic/184941/terrapin-ssh-attack", }, { url: "https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5", }, { url: "https://github.com/rapier1/hpn-ssh/releases", }, { url: "https://github.com/proftpd/proftpd/issues/456", }, { url: "https://github.com/TeraTermProject/teraterm/releases/tag/v5.1", }, { url: "https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15", }, { url: "https://oryx-embedded.com/download/#changelog", }, { url: "https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update", }, { url: "https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22", }, { url: "https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab", }, { url: "https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3", }, { url: "https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC", }, { url: "https://crates.io/crates/thrussh/versions", }, { url: "https://github.com/NixOS/nixpkgs/pull/275249", }, { name: "[oss-security] 20231219 Re: CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)", tags: [ "mailing-list", ], url: "http://www.openwall.com/lists/oss-security/2023/12/19/5", }, { url: "https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc", }, { url: "https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/", }, { name: "[oss-security] 20231220 Re: CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)", tags: [ "mailing-list", ], url: "http://www.openwall.com/lists/oss-security/2023/12/20/3", }, { url: "http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html", }, { url: "https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES", }, { url: "https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES", }, { url: "https://github.com/apache/mina-sshd/issues/445", }, { url: "https://github.com/hierynomus/sshj/issues/916", }, { url: "https://github.com/janmojzis/tinyssh/issues/81", }, { url: "https://www.openwall.com/lists/oss-security/2023/12/20/3", }, { url: "https://security-tracker.debian.org/tracker/source-package/trilead-ssh2", }, { url: "https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16", }, { name: "FEDORA-2023-0733306be9", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/", }, { name: "DSA-5586", tags: [ "vendor-advisory", ], url: "https://www.debian.org/security/2023/dsa-5586", }, { url: "https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508", }, { url: "https://www.theregister.com/2023/12/20/terrapin_attack_ssh", }, { url: "https://filezilla-project.org/versions.php", }, { url: "https://nova.app/releases/#v11.8", }, { url: "https://roumenpetrov.info/secsh/#news20231220", }, { url: "https://www.vandyke.com/products/securecrt/history.txt", }, { url: "https://help.panic.com/releasenotes/transmit5/", }, { url: "https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta", }, { url: "https://github.com/PowerShell/Win32-OpenSSH/issues/2189", }, { url: "https://winscp.net/eng/docs/history#6.2.2", }, { url: "https://www.bitvise.com/ssh-client-version-history#933", }, { url: "https://github.com/cyd01/KiTTY/issues/520", }, { name: "DSA-5588", tags: [ "vendor-advisory", ], url: "https://www.debian.org/security/2023/dsa-5588", }, { url: "https://github.com/ssh-mitm/ssh-mitm/issues/165", }, { url: "https://news.ycombinator.com/item?id=38732005", }, { name: "[debian-lts-announce] 20231226 [SECURITY] [DLA 3694-1] openssh security update", tags: [ "mailing-list", ], url: "https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html", }, { name: "GLSA-202312-16", tags: [ "vendor-advisory", ], url: "https://security.gentoo.org/glsa/202312-16", }, { name: "GLSA-202312-17", tags: [ "vendor-advisory", ], url: "https://security.gentoo.org/glsa/202312-17", }, { name: "FEDORA-2023-20feb865d8", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/", }, { name: "FEDORA-2023-cb8c606fbb", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y/", }, { name: "FEDORA-2023-e77300e4b5", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/", }, { name: "FEDORA-2023-b87ec6cf47", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7/", }, { name: "FEDORA-2023-153404713b", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD/", }, { url: "https://security.netapp.com/advisory/ntap-20240105-0004/", }, { name: "FEDORA-2024-3bb23c77f3", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS/", }, { name: "FEDORA-2023-55800423a8", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/", }, { name: "FEDORA-2024-d946b9ad25", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/", }, { name: "FEDORA-2024-71c2c6526c", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6/", }, { name: "FEDORA-2024-39a8c72ea9", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/", }, { url: "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002", }, { name: "FEDORA-2024-ae653fb07b", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/", }, { name: "FEDORA-2024-2705241461", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/", }, { name: "FEDORA-2024-fb32950d11", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/", }, { name: "FEDORA-2024-7b08207cdb", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/", }, { name: "FEDORA-2024-06ebb70bdd", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/", }, { name: "[debian-lts-announce] 20240125 [SECURITY] [DLA 3718-1] php-phpseclib security update", tags: [ "mailing-list", ], url: "https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html", }, { name: "[debian-lts-announce] 20240125 [SECURITY] [DLA 3719-1] phpseclib security update", tags: [ "mailing-list", ], url: "https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html", }, { name: "FEDORA-2024-a53b24023d", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/", }, { name: "FEDORA-2024-3fd1bc9276", tags: [ "vendor-advisory", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/", }, { url: "https://support.apple.com/kb/HT214084", }, { name: "20240313 APPLE-SA-03-07-2024-2 macOS Sonoma 14.4", tags: [ "mailing-list", ], url: "http://seclists.org/fulldisclosure/2024/Mar/21", }, { name: "[debian-lts-announce] 20240425 [SECURITY] [DLA 3794-1] putty security update", tags: [ "mailing-list", ], url: "https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html", }, { name: "[oss-security] 20240417 Terrapin vulnerability in Jenkins CLI client", tags: [ "mailing-list", ], url: "http://www.openwall.com/lists/oss-security/2024/04/17/8", }, { name: "[oss-security] 20240306 Multiple vulnerabilities in Jenkins plugins", tags: [ "mailing-list", ], url: "http://www.openwall.com/lists/oss-security/2024/03/06/3", }, ], }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2023-48795", datePublished: "2023-12-18T00:00:00", dateReserved: "2023-11-20T00:00:00", dateUpdated: "2024-08-02T21:46:27.255Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2025-21545
Vulnerability from cvelistv5
Published
2025-01-21 20:53
Modified
2025-01-22 18:01
Severity ?
EPSS score ?
Summary
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch). Supported versions that are affected are 8.60 and 8.61. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
References
â–Ľ | URL | Tags |
---|---|---|
https://www.oracle.com/security-alerts/cpujan2025.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Oracle Corporation | PeopleSoft Enterprise PeopleTools |
Version: 8.60 Version: 8.61 cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.60:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:* |
{ containers: { adp: [ { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2025-21545", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2025-01-22T18:00:23.131355Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-770", description: "CWE-770 Allocation of Resources Without Limits or Throttling", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-22T18:01:10.507Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { cpes: [ "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.60:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*", ], product: "PeopleSoft Enterprise PeopleTools", vendor: "Oracle Corporation", versions: [ { status: "affected", version: "8.60", }, { status: "affected", version: "8.61", }, ], }, ], descriptions: [ { lang: "en-US", value: "Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch). Supported versions that are affected are 8.60 and 8.61. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { description: "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.", lang: "en-US", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-21T20:53:14.338Z", orgId: "43595867-4340-4103-b7a2-9a5208d29a85", shortName: "oracle", }, references: [ { name: "Oracle Advisory", tags: [ "vendor-advisory", ], url: "https://www.oracle.com/security-alerts/cpujan2025.html", }, ], }, }, cveMetadata: { assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85", assignerShortName: "oracle", cveId: "CVE-2025-21545", datePublished: "2025-01-21T20:53:14.338Z", dateReserved: "2024-12-24T23:18:54.774Z", dateUpdated: "2025-01-22T18:01:10.507Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-35195
Vulnerability from cvelistv5
Published
2024-05-20 20:14
Modified
2025-02-13 17:52
Severity ?
EPSS score ?
Summary
Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.
References
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:request_project:request:2.32.0:*:*:*:*:node.js:*:*", ], defaultStatus: "unknown", product: "request", vendor: "request_project", versions: [ { lessThan: "2.32.0", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2024-35195", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-05-21T14:17:58.814431Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-06-06T19:18:52.607Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T03:07:46.774Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56", tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56", }, { name: "https://github.com/psf/requests/pull/6655", tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://github.com/psf/requests/pull/6655", }, { name: "https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac", tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q/", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "requests", vendor: "psf", versions: [ { status: "affected", version: "< 2.32.0", }, ], }, ], descriptions: [ { lang: "en", value: "Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.6, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-670", description: "CWE-670: Always-Incorrect Control Flow Implementation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-06-10T16:09:17.143Z", orgId: "a0819718-46f1-4df5-94e2-005712e83aaa", shortName: "GitHub_M", }, references: [ { name: "https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56", tags: [ "x_refsource_CONFIRM", ], url: "https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56", }, { name: "https://github.com/psf/requests/pull/6655", tags: [ "x_refsource_MISC", ], url: "https://github.com/psf/requests/pull/6655", }, { name: "https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac", tags: [ "x_refsource_MISC", ], url: "https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q/", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ/", }, ], source: { advisory: "GHSA-9wx4-h78v-vm56", discovery: "UNKNOWN", }, title: "Requests `Session` object does not verify requests after making first request with verify=False", }, }, cveMetadata: { assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa", assignerShortName: "GitHub_M", cveId: "CVE-2024-35195", datePublished: "2024-05-20T20:14:48.206Z", dateReserved: "2024-05-10T14:24:24.342Z", dateUpdated: "2025-02-13T17:52:32.002Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2025-21562
Vulnerability from cvelistv5
Published
2025-01-21 20:53
Modified
2025-02-04 16:09
Severity ?
EPSS score ?
Summary
Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
References
â–Ľ | URL | Tags |
---|---|---|
https://www.oracle.com/security-alerts/cpujan2025.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Oracle Corporation | PeopleSoft Enterprise CC Common Application Objects |
Version: 9.2 cpe:2.3:a:oracle:peoplesoft_enterprise_cc_common_application_objects:9.2:*:*:*:*:*:*:* |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2025-21562", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2025-01-22T15:01:13.728956Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-863", description: "CWE-863 Incorrect Authorization", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-02-04T16:09:16.487Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { cpes: [ "cpe:2.3:a:oracle:peoplesoft_enterprise_cc_common_application_objects:9.2:*:*:*:*:*:*:*", ], product: "PeopleSoft Enterprise CC Common Application Objects", vendor: "Oracle Corporation", versions: [ { status: "affected", version: "9.2", }, ], }, ], descriptions: [ { lang: "en-US", value: "Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { description: "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise CC Common Application Objects accessible data.", lang: "en-US", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-21T20:53:20.855Z", orgId: "43595867-4340-4103-b7a2-9a5208d29a85", shortName: "oracle", }, references: [ { name: "Oracle Advisory", tags: [ "vendor-advisory", ], url: "https://www.oracle.com/security-alerts/cpujan2025.html", }, ], }, }, cveMetadata: { assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85", assignerShortName: "oracle", cveId: "CVE-2025-21562", datePublished: "2025-01-21T20:53:20.855Z", dateReserved: "2024-12-24T23:18:54.782Z", dateUpdated: "2025-02-04T16:09:16.487Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-4030
Vulnerability from cvelistv5
Published
2024-05-07 21:02
Modified
2024-09-07 02:44
Severity ?
EPSS score ?
Summary
On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions.
If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user.
This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Python Software Foundation | CPython |
Version: 0 Version: 3.9.0 Version: 3.10.0 Version: 3.11.0 Version: 3.12.0 Version: 3.13.0a1 |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:python:cpython:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "cpython", vendor: "python", versions: [ { status: "affected", version: "0", }, { status: "affected", version: "3.13.0a1", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 7.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2024-4030", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-05-08T15:32:37.215710Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-06-04T17:55:02.857Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-01T20:26:57.265Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "vendor-advisory", "x_transferred", ], url: "https://mail.python.org/archives/list/security-announce@python.org/thread/PRGS5OR3N3PNPT4BMV2VAGN5GMUI5636/", }, { tags: [ "issue-tracking", "x_transferred", ], url: "https://github.com/python/cpython/issues/118486", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/81939dad77001556c527485d31a2d0f4a759033e", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/8ed546679524140d8282175411fd141fe7df070d", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/35c799d79177b962ddace2fa068101465570a29a", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/5130731c9e779b97d00a24f54cdce73ce9975dfd", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/66f8bb76a15e64a1bb7688b177ed29e26230fdee", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/6d0850c4c8188035643586ab4d8ec2468abd699e", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/91e3669e01245185569d09e9e6e11641282971ee", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/94591dca510c796c7d40e9b4167ea56f2fdf28ca", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/c8f868dc52f98011d0f9b459b6487920bfb0ac4d", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/d86b49411753bf2c83291e3a14ae43fefded2f84", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/e1dfa978b1ad210d551385ad8073ec6154f53763", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/eb29e2f5905da93333d1ce78bc98b151e763ff46", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240705-0005/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", platforms: [ "Windows", ], product: "CPython", repo: "https://github.com/python/cpython", vendor: "Python Software Foundation", versions: [ { lessThan: "3.8.20", status: "affected", version: "0", versionType: "python", }, { lessThan: "3.9.20", status: "affected", version: "3.9.0", versionType: "python", }, { lessThan: "3.10.15", status: "affected", version: "3.10.0", versionType: "python", }, { lessThan: "3.11.10", status: "affected", version: "3.11.0", versionType: "python", }, { lessThan: "3.12.4", status: "affected", version: "3.12.0", versionType: "python", }, { lessThan: "3.13.0b1", status: "affected", version: "3.13.0a1", versionType: "python", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "Aobo Wang", }, ], descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "<p><span style=\"background-color: transparent;\">On Windows a directory returned by </span><span style=\"background-color: transparent;\">tempfile.mkdtemp()</span><span style=\"background-color: transparent;\"> would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions.</span></p><p><span style=\"background-color: transparent;\">If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user.</span></p><span style=\"background-color: transparent;\">This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the </span><span style=\"background-color: transparent;\">mkdir</span><span style=\"background-color: transparent;\"> function on Windows which is used by </span><span style=\"background-color: transparent;\">mkdtemp()</span><span style=\"background-color: transparent;\"> to ensure the newly created directory has the proper permissions.</span><br>", }, ], value: "On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions.\n\nIf you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user.\n\nThis issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.", }, ], impacts: [ { capecId: "CAPEC-1", descriptions: [ { lang: "en", value: "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-276", description: "CWE-276 Incorrect Default Permissions", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-07T02:44:36.613Z", orgId: "28c92f92-d60d-412d-b760-e73465c3df22", shortName: "PSF", }, references: [ { tags: [ "vendor-advisory", ], url: "https://mail.python.org/archives/list/security-announce@python.org/thread/PRGS5OR3N3PNPT4BMV2VAGN5GMUI5636/", }, { tags: [ "issue-tracking", ], url: "https://github.com/python/cpython/issues/118486", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/81939dad77001556c527485d31a2d0f4a759033e", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/8ed546679524140d8282175411fd141fe7df070d", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/35c799d79177b962ddace2fa068101465570a29a", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/5130731c9e779b97d00a24f54cdce73ce9975dfd", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/66f8bb76a15e64a1bb7688b177ed29e26230fdee", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/6d0850c4c8188035643586ab4d8ec2468abd699e", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/91e3669e01245185569d09e9e6e11641282971ee", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/94591dca510c796c7d40e9b4167ea56f2fdf28ca", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/c8f868dc52f98011d0f9b459b6487920bfb0ac4d", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/d86b49411753bf2c83291e3a14ae43fefded2f84", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/e1dfa978b1ad210d551385ad8073ec6154f53763", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/eb29e2f5905da93333d1ce78bc98b151e763ff46", }, { url: "https://security.netapp.com/advisory/ntap-20240705-0005/", }, ], source: { discovery: "UNKNOWN", }, title: "tempfile.mkdtemp() may be readable and writeable by all users on Windows", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "28c92f92-d60d-412d-b760-e73465c3df22", assignerShortName: "PSF", cveId: "CVE-2024-4030", datePublished: "2024-05-07T21:02:55.284Z", dateReserved: "2024-04-22T14:49:13.316Z", dateUpdated: "2024-09-07T02:44:36.613Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-4603
Vulnerability from cvelistv5
Published
2024-05-16 15:21
Modified
2024-10-14 14:56
Severity ?
EPSS score ?
Summary
Issue summary: Checking excessively long DSA keys or parameters may be very
slow.
Impact summary: Applications that use the functions EVP_PKEY_param_check()
or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may
experience long delays. Where the key or parameters that are being checked
have been obtained from an untrusted source this may lead to a Denial of
Service.
The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform
various checks on DSA parameters. Some of those computations take a long time
if the modulus (`p` parameter) is too large.
Trying to use a very large modulus is slow and OpenSSL will not allow using
public keys with a modulus which is over 10,000 bits in length for signature
verification. However the key and parameter check functions do not limit
the modulus size when performing the checks.
An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()
and supplies a key or parameters obtained from an untrusted source could be
vulnerable to a Denial of Service attack.
These functions are not called by OpenSSL itself on untrusted DSA keys so
only applications that directly call these functions may be vulnerable.
Also vulnerable are the OpenSSL pkey and pkeyparam command line applications
when using the `-check` option.
The OpenSSL SSL/TLS implementation is not affected by this issue.
The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.
References
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-01T20:47:41.528Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "OpenSSL Advisory", tags: [ "vendor-advisory", "x_transferred", ], url: "https://www.openssl.org/news/secadv/20240516.txt", }, { name: "3.0.14 git commit", tags: [ "patch", "x_transferred", ], url: "https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397", }, { name: "3.1.6 git commit", tags: [ "patch", "x_transferred", ], url: "https://github.com/openssl/openssl/commit/9c39b3858091c152f52513c066ff2c5a47969f0d", }, { name: "3.2.2 git commit", tags: [ "patch", "x_transferred", ], url: "https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740", }, { name: "3.3.1 git commit", tags: [ "patch", "x_transferred", ], url: "https://github.com/openssl/openssl/commit/53ea06486d296b890d565fb971b2764fcd826e7e", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/05/16/2", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240621-0001/", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", ], defaultStatus: "unaffected", product: "openssl", vendor: "openssl", versions: [ { lessThan: "3.0.14", status: "affected", version: "3.0.0", versionType: "semver", }, { lessThan: "3.1.6", status: "affected", version: "3.1.0", versionType: "semver", }, { lessThan: "3.2.2", status: "affected", version: "3.2.0", versionType: "semver", }, { lessThan: "3.3.1", status: "affected", version: "3.3.0", versionType: "semver", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.1", }, }, { other: { content: { id: "CVE-2024-4603", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-05-16T18:27:25.638098Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-834", description: "CWE-834 Excessive Iteration", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-08-13T15:11:57.009Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "OpenSSL", vendor: "OpenSSL", versions: [ { lessThan: "3.0.14", status: "affected", version: "3.0.0", versionType: "semver", }, { lessThan: "3.1.6", status: "affected", version: "3.1.0", versionType: "semver", }, { lessThan: "3.2.2", status: "affected", version: "3.2.0", versionType: "semver", }, { lessThan: "3.3.1", status: "affected", version: "3.3.0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "OSS-Fuzz", }, { lang: "en", type: "remediation developer", user: "00000000-0000-4000-9000-000000000000", value: "Tomas Mraz", }, ], datePublic: "2024-05-16T00:00:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "Issue summary: Checking excessively long DSA keys or parameters may be very<br>slow.<br><br>Impact summary: Applications that use the functions EVP_PKEY_param_check()<br>or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may<br>experience long delays. Where the key or parameters that are being checked<br>have been obtained from an untrusted source this may lead to a Denial of<br>Service.<br><br>The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform<br>various checks on DSA parameters. Some of those computations take a long time<br>if the modulus (`p` parameter) is too large.<br><br>Trying to use a very large modulus is slow and OpenSSL will not allow using<br>public keys with a modulus which is over 10,000 bits in length for signature<br>verification. However the key and parameter check functions do not limit<br>the modulus size when performing the checks.<br><br>An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()<br>and supplies a key or parameters obtained from an untrusted source could be<br>vulnerable to a Denial of Service attack.<br><br>These functions are not called by OpenSSL itself on untrusted DSA keys so<br>only applications that directly call these functions may be vulnerable.<br><br>Also vulnerable are the OpenSSL pkey and pkeyparam command line applications<br>when using the `-check` option.<br><br>The OpenSSL SSL/TLS implementation is not affected by this issue.<br><br>The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.", }, ], value: "Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.", }, ], metrics: [ { format: "other", other: { content: { text: "Low", }, type: "https://www.openssl.org/policies/secpolicy.html", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-606", description: "CWE-606 Unchecked Input for Loop Condition", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-10-14T14:56:01.784Z", orgId: "3a12439a-ef3a-4c79-92e6-6081a721f1e5", shortName: "openssl", }, references: [ { name: "OpenSSL Advisory", tags: [ "vendor-advisory", ], url: "https://www.openssl.org/news/secadv/20240516.txt", }, { name: "3.0.14 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397", }, { name: "3.1.6 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/9c39b3858091c152f52513c066ff2c5a47969f0d", }, { name: "3.2.2 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740", }, { name: "3.3.1 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/53ea06486d296b890d565fb971b2764fcd826e7e", }, ], source: { discovery: "UNKNOWN", }, title: "Excessive time spent checking DSA keys and parameters", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "3a12439a-ef3a-4c79-92e6-6081a721f1e5", assignerShortName: "openssl", cveId: "CVE-2024-4603", datePublished: "2024-05-16T15:21:20.050Z", dateReserved: "2024-05-07T11:44:02.196Z", dateUpdated: "2024-10-14T14:56:01.784Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-27281
Vulnerability from cvelistv5
Published
2024-05-08 20:56
Modified
2025-02-13 15:47
Severity ?
EPSS score ?
Summary
An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. (When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.) The main fixed version is 6.6.3.1. For Ruby 3.0 users, a fixed version is rdoc 6.3.4.1. For Ruby 3.1 users, a fixed version is rdoc 6.4.1.1. For Ruby 3.2 users, a fixed version is rdoc 6.5.1.1.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T00:27:59.953Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://hackerone.com/reports/1187477", }, { tags: [ "x_transferred", ], url: "https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:ruby:rdoc:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "rdoc", vendor: "ruby", versions: [ { lessThanOrEqual: "6.6.2", status: "affected", version: "6.3.3", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "LOW", baseScore: 4.5, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.1", }, }, { other: { content: { id: "CVE-2024-27281", options: [ { Exploitation: "poc", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-08-20T13:50:49.740883Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-502", description: "CWE-502 Deserialization of Untrusted Data", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-08-20T14:02:13.614Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], descriptions: [ { lang: "en", value: "An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. (When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.) The main fixed version is 6.6.3.1. For Ruby 3.0 users, a fixed version is rdoc 6.3.4.1. For Ruby 3.1 users, a fixed version is rdoc 6.4.1.1. For Ruby 3.2 users, a fixed version is rdoc 6.5.1.1.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2024-05-08T20:56:26.831Z", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { url: "https://hackerone.com/reports/1187477", }, { url: "https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/", }, ], }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2024-27281", datePublished: "2024-05-08T20:56:26.427Z", dateReserved: "2024-02-22T00:00:00.000Z", dateUpdated: "2025-02-13T15:47:15.798Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-38998
Vulnerability from cvelistv5
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Show details on NVD website{ containers: { cna: { providerMetadata: { dateUpdated: "2025-01-28T19:44:53.337Z", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, rejectedReasons: [ { lang: "en", value: "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", }, ], }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2024-38998", datePublished: "2024-07-01T00:00:00.000Z", dateRejected: "2025-01-28T00:00:00", dateReserved: "2024-06-21T00:00:00.000Z", dateUpdated: "2025-01-28T19:44:53.337Z", state: "REJECTED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2025-21530
Vulnerability from cvelistv5
Published
2025-01-21 20:53
Modified
2025-01-22 18:09
Severity ?
EPSS score ?
Summary
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.60 and 8.61. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
References
â–Ľ | URL | Tags |
---|---|---|
https://www.oracle.com/security-alerts/cpujan2025.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Oracle Corporation | PeopleSoft Enterprise PeopleTools |
Version: 8.60 Version: 8.61 cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.60:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:* |
{ containers: { adp: [ { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2025-21530", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2025-01-22T18:08:21.314026Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-125", description: "CWE-125 Out-of-bounds Read", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-22T18:09:00.246Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { cpes: [ "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.60:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*", ], product: "PeopleSoft Enterprise PeopleTools", vendor: "Oracle Corporation", versions: [ { status: "affected", version: "8.60", }, { status: "affected", version: "8.61", }, ], }, ], descriptions: [ { lang: "en-US", value: "Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.60 and 8.61. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { description: "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data.", lang: "en-US", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-21T20:53:08.312Z", orgId: "43595867-4340-4103-b7a2-9a5208d29a85", shortName: "oracle", }, references: [ { name: "Oracle Advisory", tags: [ "vendor-advisory", ], url: "https://www.oracle.com/security-alerts/cpujan2025.html", }, ], }, }, cveMetadata: { assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85", assignerShortName: "oracle", cveId: "CVE-2025-21530", datePublished: "2025-01-21T20:53:08.312Z", dateReserved: "2024-12-24T23:18:54.770Z", dateUpdated: "2025-01-22T18:09:00.246Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-2511
Vulnerability from cvelistv5
Published
2024-04-08 13:51
Modified
2024-10-14 14:56
Severity ?
EPSS score ?
Summary
Issue summary: Some non-default TLS server configurations can cause unbounded
memory growth when processing TLSv1.3 sessions
Impact summary: An attacker may exploit certain server configurations to trigger
unbounded memory growth that would lead to a Denial of Service
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
being used (but not if early_data support is also configured and the default
anti-replay protection is in use). In this case, under certain conditions, the
session cache can get into an incorrect state and it will fail to flush properly
as it fills. The session cache will continue to grow in an unbounded manner. A
malicious client could deliberately create the scenario for this failure to
force a Denial of Service. It may also happen by accident in normal operation.
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
clients.
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
1.0.2 is also not affected by this issue.
References
Impacted products
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-2511", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-04-09T15:14:41.481807Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-06-04T17:30:50.015Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-01T19:18:46.968Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "OpenSSL Advisory", tags: [ "vendor-advisory", "x_transferred", ], url: "https://www.openssl.org/news/secadv/20240408.txt", }, { name: "3.2.2 git commit", tags: [ "patch", "x_transferred", ], url: "https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08", }, { name: "3.1.6 git commit", tags: [ "patch", "x_transferred", ], url: "https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce", }, { name: "3.0.14 git commit", tags: [ "patch", "x_transferred", ], url: "https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d", }, { name: "1.1.1y git commit", tags: [ "patch", "x_transferred", ], url: "https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/04/08/5", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240503-0013/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "OpenSSL", vendor: "OpenSSL", versions: [ { lessThan: "3.2.2", status: "affected", version: "3.2.0", versionType: "semver", }, { lessThan: "3.1.6", status: "affected", version: "3.1.0", versionType: "semver", }, { lessThan: "3.0.14", status: "affected", version: "3.0.0", versionType: "semver", }, { lessThan: "1.1.1y", status: "affected", version: "1.1.1", versionType: "custom", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Manish Patidar (Hewlett Packard Enterprise)", }, { lang: "en", type: "remediation developer", user: "00000000-0000-4000-9000-000000000000", value: "Matt Caswell", }, ], datePublic: "2024-04-08T00:00:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "Issue summary: Some non-default TLS server configurations can cause unbounded<br>memory growth when processing TLSv1.3 sessions<br><br>Impact summary: An attacker may exploit certain server configurations to trigger<br>unbounded memory growth that would lead to a Denial of Service<br><br>This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is<br>being used (but not if early_data support is also configured and the default<br>anti-replay protection is in use). In this case, under certain conditions, the<br>session cache can get into an incorrect state and it will fail to flush properly<br>as it fills. The session cache will continue to grow in an unbounded manner. A<br>malicious client could deliberately create the scenario for this failure to<br>force a Denial of Service. It may also happen by accident in normal operation.<br><br>This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS<br>clients.<br><br>The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL<br>1.0.2 is also not affected by this issue.", }, ], value: "Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue.", }, ], metrics: [ { format: "other", other: { content: { text: "Low", }, type: "https://www.openssl.org/policies/secpolicy.html", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-1325", description: "CWE-1325 Improperly Controlled Sequential Memory Allocation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-10-14T14:56:00.208Z", orgId: "3a12439a-ef3a-4c79-92e6-6081a721f1e5", shortName: "openssl", }, references: [ { name: "OpenSSL Advisory", tags: [ "vendor-advisory", ], url: "https://www.openssl.org/news/secadv/20240408.txt", }, { name: "3.2.2 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08", }, { name: "3.1.6 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce", }, { name: "3.0.14 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d", }, { name: "1.1.1y git commit", tags: [ "patch", ], url: "https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640", }, ], source: { discovery: "UNKNOWN", }, title: "Unbounded memory growth with session handling in TLSv1.3", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "3a12439a-ef3a-4c79-92e6-6081a721f1e5", assignerShortName: "openssl", cveId: "CVE-2024-2511", datePublished: "2024-04-08T13:51:12.349Z", dateReserved: "2024-03-15T15:33:52.037Z", dateUpdated: "2024-10-14T14:56:00.208Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-7592
Vulnerability from cvelistv5
Published
2024-08-19 19:06
Modified
2025-01-31 19:55
Severity ?
EPSS score ?
Summary
There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module.
When parsing cookies that contained backslashes for quoted characters in
the cookie value, the parser would use an algorithm with quadratic
complexity, resulting in excess CPU resources being used while parsing the
value.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Python Software Foundation | CPython |
Version: 0 Version: 3.9.0 Version: 3.10.0 Version: 3.11.0 Version: 3.12.0 Version: 3.13.0a1 |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:python:cpython:*:*:*:*:*:*:*:*", ], defaultStatus: "unaffected", product: "cpython", vendor: "python", versions: [ { lessThan: "3.8.20", status: "affected", version: "0", versionType: "python", }, { lessThan: "3.9.20", status: "affected", version: "3.9.0", versionType: "python", }, { lessThan: "3.10.15", status: "affected", version: "3.10.0", versionType: "python", }, { lessThan: "3.11.10", status: "affected", version: "3.11.0", versionType: "python", }, { lessThan: "3.12.6", status: "affected", version: "3.12.0", versionType: "python", }, { lessThan: "3.13.0rc2", status: "affected", version: "3.13.0a1", versionType: "python", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2024-7592", options: [ { Exploitation: "poc", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-09-03T17:21:02.520596Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-09-09T20:53:12.739Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-10-18T13:07:47.143Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { url: "https://security.netapp.com/advisory/ntap-20241018-0006/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CPython", repo: "https://github.com/python/cpython", vendor: "Python Software Foundation", versions: [ { lessThan: "3.8.20", status: "affected", version: "0", versionType: "python", }, { lessThan: "3.9.20", status: "affected", version: "3.9.0", versionType: "python", }, { lessThan: "3.10.15", status: "affected", version: "3.10.0", versionType: "python", }, { lessThan: "3.11.10", status: "affected", version: "3.11.0", versionType: "python", }, { lessThan: "3.12.6", status: "affected", version: "3.12.0", versionType: "python", }, { lessThan: "3.13.0rc2", status: "affected", version: "3.13.0a1", versionType: "python", }, ], }, ], datePublic: "2024-08-16T16:15:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "<p>There is a LOW severity vulnerability affecting CPython, specifically the\n'<i><b>http.cookies</b></i>' standard library module.</p>\n<p>When parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue.</p><br><p></p>", }, ], value: "There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue.", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-400", description: "CWE-400 Uncontrolled Resource Consumption", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-31T19:55:12.119Z", orgId: "28c92f92-d60d-412d-b760-e73465c3df22", shortName: "PSF", }, references: [ { tags: [ "patch", ], url: "https://github.com/python/cpython/pull/123075", }, { tags: [ "issue-tracking", ], url: "https://github.com/python/cpython/issues/123067", }, { tags: [ "vendor-advisory", ], url: "https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef", }, ], source: { discovery: "UNKNOWN", }, title: "Quadratic complexity parsing cookies with backslashes", x_generator: { engine: "Vulnogram 0.2.0", }, }, }, cveMetadata: { assignerOrgId: "28c92f92-d60d-412d-b760-e73465c3df22", assignerShortName: "PSF", cveId: "CVE-2024-7592", datePublished: "2024-08-19T19:06:45.311Z", dateReserved: "2024-08-07T15:53:07.135Z", dateUpdated: "2025-01-31T19:55:12.119Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-28849
Vulnerability from cvelistv5
Published
2024-03-14 17:07
Modified
2025-02-13 17:47
Severity ?
EPSS score ?
Summary
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
follow-redirects | follow-redirects |
Version: < 1.15.6 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T00:56:58.148Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp", tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp", }, { name: "https://github.com/psf/requests/issues/1885", tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://github.com/psf/requests/issues/1885", }, { name: "https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b", tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b", }, { name: "https://hackerone.com/reports/2390009", tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://hackerone.com/reports/2390009", }, { name: "https://fetch.spec.whatwg.org/#authentication-entries", tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://fetch.spec.whatwg.org/#authentication-entries", }, { tags: [ "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOIF4EPQUCKDBEVTGRQDZ3CGTYQHPO7Z/", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:follow-redirects_project:follow-redirects:*:*:*:*:*:node.js:*:*", ], defaultStatus: "unknown", product: "follow-redirects", vendor: "follow-redirects_project", versions: [ { lessThan: "1.15.6", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2024-28849", options: [ { Exploitation: "poc", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-08-02T19:45:25.235625Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-08-02T19:46:22.123Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "follow-redirects", vendor: "follow-redirects", versions: [ { status: "affected", version: "< 1.15.6", }, ], }, ], descriptions: [ { lang: "en", value: "follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-200", description: "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-03-23T03:06:02.341Z", orgId: "a0819718-46f1-4df5-94e2-005712e83aaa", shortName: "GitHub_M", }, references: [ { name: "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp", tags: [ "x_refsource_CONFIRM", ], url: "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp", }, { name: "https://github.com/psf/requests/issues/1885", tags: [ "x_refsource_MISC", ], url: "https://github.com/psf/requests/issues/1885", }, { name: "https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b", tags: [ "x_refsource_MISC", ], url: "https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b", }, { name: "https://hackerone.com/reports/2390009", tags: [ "x_refsource_MISC", ], url: "https://hackerone.com/reports/2390009", }, { name: "https://fetch.spec.whatwg.org/#authentication-entries", tags: [ "x_refsource_MISC", ], url: "https://fetch.spec.whatwg.org/#authentication-entries", }, { url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOIF4EPQUCKDBEVTGRQDZ3CGTYQHPO7Z/", }, ], source: { advisory: "GHSA-cxjh-pqwp-8mfp", discovery: "UNKNOWN", }, title: "Proxy-Authorization header kept across hosts in follow-redirects", }, }, cveMetadata: { assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa", assignerShortName: "GitHub_M", cveId: "CVE-2024-28849", datePublished: "2024-03-14T17:07:27.338Z", dateReserved: "2024-03-11T22:45:07.685Z", dateUpdated: "2025-02-13T17:47:32.862Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-29025
Vulnerability from cvelistv5
Published
2024-03-25 20:09
Modified
2025-02-13 17:47
Severity ?
EPSS score ?
Summary
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.
References
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "netty", vendor: "netty", versions: [ { lessThan: "4.1.108.Final", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2024-29025", options: [ { Exploitation: "poc", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-07-19T15:54:48.153095Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-07-19T21:08:16.746Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T01:03:51.668Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v", tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v", }, { name: "https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c", tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c", }, { name: "https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3", tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3", }, { tags: [ "x_transferred", ], url: "https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "netty", vendor: "netty", versions: [ { status: "affected", version: "< 4.1.108.Final", }, ], }, ], descriptions: [ { lang: "en", value: "Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-770", description: "CWE-770: Allocation of Resources Without Limits or Throttling", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-06-21T22:06:06.551Z", orgId: "a0819718-46f1-4df5-94e2-005712e83aaa", shortName: "GitHub_M", }, references: [ { name: "https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v", tags: [ "x_refsource_CONFIRM", ], url: "https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v", }, { name: "https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c", tags: [ "x_refsource_MISC", ], url: "https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c", }, { name: "https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3", tags: [ "x_refsource_MISC", ], url: "https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3", }, { url: "https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html", }, ], source: { advisory: "GHSA-5jpm-x58v-624v", discovery: "UNKNOWN", }, title: "Netty HttpPostRequestDecoder can OOM", }, }, cveMetadata: { assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa", assignerShortName: "GitHub_M", cveId: "CVE-2024-29025", datePublished: "2024-03-25T20:09:35.156Z", dateReserved: "2024-03-14T16:59:47.611Z", dateUpdated: "2025-02-13T17:47:35.781Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-5535
Vulnerability from cvelistv5
Published
2024-06-27 10:30
Modified
2025-02-13 17:54
Severity ?
EPSS score ?
Summary
Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an
empty supported client protocols buffer may cause a crash or memory contents to
be sent to the peer.
Impact summary: A buffer overread can have a range of potential consequences
such as unexpected application beahviour or a crash. In particular this issue
could result in up to 255 bytes of arbitrary private data from memory being sent
to the peer leading to a loss of confidentiality. However, only applications
that directly call the SSL_select_next_proto function with a 0 length list of
supported client protocols are affected by this issue. This would normally never
be a valid scenario and is typically not under attacker control but may occur by
accident in the case of a configuration or programming error in the calling
application.
The OpenSSL API function SSL_select_next_proto is typically used by TLS
applications that support ALPN (Application Layer Protocol Negotiation) or NPN
(Next Protocol Negotiation). NPN is older, was never standardised and
is deprecated in favour of ALPN. We believe that ALPN is significantly more
widely deployed than NPN. The SSL_select_next_proto function accepts a list of
protocols from the server and a list of protocols from the client and returns
the first protocol that appears in the server list that also appears in the
client list. In the case of no overlap between the two lists it returns the
first item in the client list. In either case it will signal whether an overlap
between the two lists was found. In the case where SSL_select_next_proto is
called with a zero length client list it fails to notice this condition and
returns the memory immediately following the client list pointer (and reports
that there was no overlap in the lists).
This function is typically called from a server side application callback for
ALPN or a client side application callback for NPN. In the case of ALPN the list
of protocols supplied by the client is guaranteed by libssl to never be zero in
length. The list of server protocols comes from the application and should never
normally be expected to be of zero length. In this case if the
SSL_select_next_proto function has been called as expected (with the list
supplied by the client passed in the client/client_len parameters), then the
application will not be vulnerable to this issue. If the application has
accidentally been configured with a zero length server list, and has
accidentally passed that zero length server list in the client/client_len
parameters, and has additionally failed to correctly handle a "no overlap"
response (which would normally result in a handshake failure in ALPN) then it
will be vulnerable to this problem.
In the case of NPN, the protocol permits the client to opportunistically select
a protocol when there is no overlap. OpenSSL returns the first client protocol
in the no overlap case in support of this. The list of client protocols comes
from the application and should never normally be expected to be of zero length.
However if the SSL_select_next_proto function is accidentally called with a
client_len of 0 then an invalid memory pointer will be returned instead. If the
application uses this output as the opportunistic protocol then the loss of
confidentiality will occur.
This issue has been assessed as Low severity because applications are most
likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not
widely used. It also requires an application configuration or programming error.
Finally, this issue would not typically be under attacker control making active
exploitation unlikely.
The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
Due to the low severity of this issue we are not issuing new releases of
OpenSSL at this time. The fix will be included in the next releases when they
become available.
References
Impacted products
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "openssl", vendor: "openssl", versions: [ { lessThan: "3.3.2", status: "affected", version: "3.3.0", versionType: "custom", }, { lessThan: "3.2.3", status: "affected", version: "3.2.0", versionType: "custom", }, { lessThan: "3.1.7", status: "affected", version: "3.1.0", versionType: "custom", }, { lessThan: "3.0.15", status: "affected", version: "3.0.0", versionType: "custom", }, { lessThan: "1.1.1za", status: "affected", version: "1.1.1", versionType: "custom", }, { lessThan: "1.0.2zk", status: "affected", version: "1.0.2", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.1, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2024-5535", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-11-08T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-11-14T04:55:17.007Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-15T12:04:53.153Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "OpenSSL Advisory", tags: [ "vendor-advisory", "x_transferred", ], url: "https://www.openssl.org/news/secadv/20240627.txt", }, { name: "3.3.2 git commit", tags: [ "patch", "x_transferred", ], url: "https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c", }, { name: "3.2.3 git commit", tags: [ "patch", "x_transferred", ], url: "https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e", }, { name: "3.1.7 git commit", tags: [ "patch", "x_transferred", ], url: "https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37", }, { name: "3.0.15 git commit", tags: [ "patch", "x_transferred", ], url: "https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c", }, { name: "1.1.1za git commit", tags: [ "patch", "x_transferred", ], url: "https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87", }, { name: "1.0.2zk git commit", tags: [ "patch", "x_transferred", ], url: "https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/06/27/1", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/06/28/4", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240712-0005/", }, { url: "http://www.openwall.com/lists/oss-security/2024/08/15/1", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "OpenSSL", vendor: "OpenSSL", versions: [ { lessThan: "3.3.2", status: "affected", version: "3.3.0", versionType: "semver", }, { lessThan: "3.2.3", status: "affected", version: "3.2.0", versionType: "semver", }, { lessThan: "3.1.7", status: "affected", version: "3.1.0", versionType: "semver", }, { lessThan: "3.0.15", status: "affected", version: "3.0.0", versionType: "semver", }, { lessThan: "1.1.1za", status: "affected", version: "1.1.1", versionType: "custom", }, { lessThan: "1.0.2zk", status: "affected", version: "1.0.2", versionType: "custom", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "Joseph Birr-Pixton", }, { lang: "en", type: "analyst", value: "David Benjamin (Google)", }, { lang: "en", type: "remediation developer", value: "Matt Caswell", }, ], datePublic: "2024-06-26T23:00:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an<br>empty supported client protocols buffer may cause a crash or memory contents to<br>be sent to the peer.<br><br>Impact summary: A buffer overread can have a range of potential consequences<br>such as unexpected application beahviour or a crash. In particular this issue<br>could result in up to 255 bytes of arbitrary private data from memory being sent<br>to the peer leading to a loss of confidentiality. However, only applications<br>that directly call the SSL_select_next_proto function with a 0 length list of<br>supported client protocols are affected by this issue. This would normally never<br>be a valid scenario and is typically not under attacker control but may occur by<br>accident in the case of a configuration or programming error in the calling<br>application.<br><br>The OpenSSL API function SSL_select_next_proto is typically used by TLS<br>applications that support ALPN (Application Layer Protocol Negotiation) or NPN<br>(Next Protocol Negotiation). NPN is older, was never standardised and<br>is deprecated in favour of ALPN. We believe that ALPN is significantly more<br>widely deployed than NPN. The SSL_select_next_proto function accepts a list of<br>protocols from the server and a list of protocols from the client and returns<br>the first protocol that appears in the server list that also appears in the<br>client list. In the case of no overlap between the two lists it returns the<br>first item in the client list. In either case it will signal whether an overlap<br>between the two lists was found. In the case where SSL_select_next_proto is<br>called with a zero length client list it fails to notice this condition and<br>returns the memory immediately following the client list pointer (and reports<br>that there was no overlap in the lists).<br><br>This function is typically called from a server side application callback for<br>ALPN or a client side application callback for NPN. In the case of ALPN the list<br>of protocols supplied by the client is guaranteed by libssl to never be zero in<br>length. The list of server protocols comes from the application and should never<br>normally be expected to be of zero length. In this case if the<br>SSL_select_next_proto function has been called as expected (with the list<br>supplied by the client passed in the client/client_len parameters), then the<br>application will not be vulnerable to this issue. If the application has<br>accidentally been configured with a zero length server list, and has<br>accidentally passed that zero length server list in the client/client_len<br>parameters, and has additionally failed to correctly handle a \"no overlap\"<br>response (which would normally result in a handshake failure in ALPN) then it<br>will be vulnerable to this problem.<br><br>In the case of NPN, the protocol permits the client to opportunistically select<br>a protocol when there is no overlap. OpenSSL returns the first client protocol<br>in the no overlap case in support of this. The list of client protocols comes<br>from the application and should never normally be expected to be of zero length.<br>However if the SSL_select_next_proto function is accidentally called with a<br>client_len of 0 then an invalid memory pointer will be returned instead. If the<br>application uses this output as the opportunistic protocol then the loss of<br>confidentiality will occur.<br><br>This issue has been assessed as Low severity because applications are most<br>likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not<br>widely used. It also requires an application configuration or programming error.<br>Finally, this issue would not typically be under attacker control making active<br>exploitation unlikely.<br><br>The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.<br><br>\n\nDue to the low severity of this issue we are not issuing new releases of<br>OpenSSL at this time. The fix will be included in the next releases when they<br>become available.", }, ], value: "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.", }, ], metrics: [ { format: "other", other: { content: { text: "Low", }, type: "https://www.openssl.org/policies/secpolicy.html", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-200", description: "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-07-12T14:06:04.752Z", orgId: "3a12439a-ef3a-4c79-92e6-6081a721f1e5", shortName: "openssl", }, references: [ { name: "OpenSSL Advisory", tags: [ "vendor-advisory", ], url: "https://www.openssl.org/news/secadv/20240627.txt", }, { name: "3.3.2 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c", }, { name: "3.2.3 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e", }, { name: "3.1.7 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37", }, { name: "3.0.15 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c", }, { name: "1.1.1za git commit", tags: [ "patch", ], url: "https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87", }, { name: "1.0.2zk git commit", tags: [ "patch", ], url: "https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c", }, { url: "http://www.openwall.com/lists/oss-security/2024/06/27/1", }, { url: "http://www.openwall.com/lists/oss-security/2024/06/28/4", }, { url: "https://security.netapp.com/advisory/ntap-20240712-0005/", }, ], source: { discovery: "UNKNOWN", }, title: "SSL_select_next_proto buffer overread", x_generator: { engine: "Vulnogram 0.2.0", }, }, }, cveMetadata: { assignerOrgId: "3a12439a-ef3a-4c79-92e6-6081a721f1e5", assignerShortName: "openssl", cveId: "CVE-2024-5535", datePublished: "2024-06-27T10:30:53.118Z", dateReserved: "2024-05-30T15:34:36.813Z", dateUpdated: "2025-02-13T17:54:20.802Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-22018
Vulnerability from cvelistv5
Published
2024-07-10 01:00
Modified
2025-02-13 17:33
Severity ?
EPSS score ?
Summary
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.
This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.
This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
References
Impacted products
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-22018", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-07-10T16:07:56.256999Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { description: "CWE-noinfo Not enough information", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-11-04T20:13:58.689Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-16T17:02:38.484Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://hackerone.com/reports/2145862", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/07/11/6", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/07/19/3", }, { url: "https://security.netapp.com/advisory/ntap-20240816-0007/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "Node.js", vendor: "Node.js", versions: [ { lessThanOrEqual: "20.11.0", status: "affected", version: "20.11.0", versionType: "semver", }, { lessThanOrEqual: "21.6.1", status: "affected", version: "21.6.1", versionType: "semver", }, ], }, ], descriptions: [ { lang: "en", value: "A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.", }, ], metrics: [ { cvssV3_0: { baseScore: 2.9, baseSeverity: "LOW", vectorString: "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.0", }, }, ], providerMetadata: { dateUpdated: "2024-07-19T14:06:03.716Z", orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", shortName: "hackerone", }, references: [ { url: "https://hackerone.com/reports/2145862", }, { url: "http://www.openwall.com/lists/oss-security/2024/07/11/6", }, { url: "http://www.openwall.com/lists/oss-security/2024/07/19/3", }, ], }, }, cveMetadata: { assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", assignerShortName: "hackerone", cveId: "CVE-2024-22018", datePublished: "2024-07-10T01:00:12.747Z", dateReserved: "2024-01-04T01:04:06.573Z", dateUpdated: "2025-02-13T17:33:25.418Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2020-22218
Vulnerability from cvelistv5
Published
2023-08-22 00:00
Modified
2024-10-03 18:09
Severity ?
EPSS score ?
Summary
An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T14:51:10.505Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://github.com/libssh2/libssh2/pull/476", }, { name: "[debian-lts-announce] 20230908 [SECURITY] [DLA 3559-1] libssh2 security update", tags: [ "mailing-list", "x_transferred", ], url: "https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20231006-0002/", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2020-22218", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-03T18:09:15.416860Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-03T18:09:37.723Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], descriptions: [ { lang: "en", value: "An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2023-10-06T14:06:28.672674", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { url: "https://github.com/libssh2/libssh2/pull/476", }, { name: "[debian-lts-announce] 20230908 [SECURITY] [DLA 3559-1] libssh2 security update", tags: [ "mailing-list", ], url: "https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html", }, { url: "https://security.netapp.com/advisory/ntap-20231006-0002/", }, ], }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2020-22218", datePublished: "2023-08-22T00:00:00", dateReserved: "2020-08-13T00:00:00", dateUpdated: "2024-10-03T18:09:37.723Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-22020
Vulnerability from cvelistv5
Published
2024-07-09 01:07
Modified
2025-02-13 17:33
Severity ?
EPSS score ?
Summary
A security flaw in Node.js allows a bypass of network import restrictions.
By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.
Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.
Exploiting this flaw can violate network import security, posing a risk to developers and servers.
References
Impacted products
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "nodejs", vendor: "nodejs", versions: [ { status: "affected", version: "21.6.1", }, { status: "affected", version: "20.11.0", }, { status: "affected", version: "18.19.0", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2024-22020", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-07-13T03:55:30.015268Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-25T17:48:27.567Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-11-22T12:04:47.763Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://hackerone.com/reports/2092749", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/07/11/6", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/07/19/3", }, { url: "https://security.netapp.com/advisory/ntap-20241122-0006/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "Node.js", vendor: "Node.js", versions: [ { lessThanOrEqual: "21.6.1", status: "affected", version: "21.6.1", versionType: "semver", }, { lessThanOrEqual: "20.11.0", status: "affected", version: "20.11.0", versionType: "semver", }, { lessThanOrEqual: "18.19.0", status: "affected", version: "18.19.0", versionType: "semver", }, ], }, ], descriptions: [ { lang: "en", value: "A security flaw in Node.js allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.", }, ], metrics: [ { cvssV3_0: { baseScore: 6.5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H", version: "3.0", }, }, ], providerMetadata: { dateUpdated: "2024-07-19T14:06:01.764Z", orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", shortName: "hackerone", }, references: [ { url: "https://hackerone.com/reports/2092749", }, { url: "http://www.openwall.com/lists/oss-security/2024/07/11/6", }, { url: "http://www.openwall.com/lists/oss-security/2024/07/19/3", }, ], }, }, cveMetadata: { assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", assignerShortName: "hackerone", cveId: "CVE-2024-22020", datePublished: "2024-07-09T01:07:28.098Z", dateReserved: "2024-01-04T01:04:06.574Z", dateUpdated: "2025-02-13T17:33:26.609Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-27280
Vulnerability from cvelistv5
Published
2024-05-08 20:51
Modified
2025-02-13 15:47
Severity ?
EPSS score ?
Summary
A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however, for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is stringio 3.0.1.2.
References
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:ruby-lang:ruby:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "ruby", vendor: "ruby-lang", versions: [ { lessThanOrEqual: "3.0.6", status: "affected", version: "3.0.3", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2024-27280", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-05-09T18:08:05.682025Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-120", description: "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-06-04T17:46:36.722Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T00:27:59.862Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://hackerone.com/reports/1399856", }, { tags: [ "x_transferred", ], url: "https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], descriptions: [ { lang: "en", value: "A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however, for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is stringio 3.0.1.2.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2024-05-08T20:51:20.724Z", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { url: "https://hackerone.com/reports/1399856", }, { url: "https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/", }, ], }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2024-27280", datePublished: "2024-05-08T20:51:20.388Z", dateReserved: "2024-02-22T00:00:00.000Z", dateUpdated: "2025-02-13T15:47:15.288Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-36137
Vulnerability from cvelistv5
Published
2024-09-07 16:00
Modified
2024-11-22 12:04
Severity ?
EPSS score ?
Summary
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.
Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.
References
Impacted products
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-36137", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-09-09T18:06:27.696158Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { description: "CWE-noinfo Not enough information", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-11-01T19:10:09.954Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-11-22T12:04:50.713Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { url: "https://security.netapp.com/advisory/ntap-20241122-0005/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "node", vendor: "nodejs", versions: [ { lessThanOrEqual: "20.15.0", status: "affected", version: "20.15.0", versionType: "semver", }, { lessThanOrEqual: "22.4.0", status: "affected", version: "22.4.0", versionType: "semver", }, ], }, ], descriptions: [ { lang: "en", value: "A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\r\n\r\nNode.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \"read-only\" file descriptor to change the owner and permissions of a file.", }, ], metrics: [ { cvssV3_0: { baseScore: 3.3, baseSeverity: "LOW", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", version: "3.0", }, }, ], providerMetadata: { dateUpdated: "2024-09-07T16:00:35.999Z", orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", shortName: "hackerone", }, references: [ { url: "https://nodejs.org/en/blog/vulnerability/july-2024-security-releases", }, ], }, }, cveMetadata: { assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", assignerShortName: "hackerone", cveId: "CVE-2024-36137", datePublished: "2024-09-07T16:00:35.999Z", dateReserved: "2024-05-21T01:04:07.208Z", dateUpdated: "2024-11-22T12:04:50.713Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-22019
Vulnerability from cvelistv5
Published
2024-02-20 01:31
Modified
2025-02-13 17:33
Severity ?
EPSS score ?
Summary
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.
References
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:node.js:node.js:*:*:*:*:*:*:*:*", ], defaultStatus: "unaffected", product: "node.js", vendor: "node.js", versions: [ { lessThanOrEqual: "21.6.1", status: "affected", version: "0", versionType: "semver", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2024-22019", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-11-07T21:15:49.148447Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-404", description: "CWE-404 Improper Resource Shutdown or Release", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-11-07T21:17:16.721Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-01T22:35:34.700Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://hackerone.com/reports/2233486", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240315-0004/", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/03/11/1", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "Node.js", vendor: "Node.js", versions: [ { lessThanOrEqual: "21.6.1", status: "affected", version: "21.6.1", versionType: "semver", }, ], }, ], descriptions: [ { lang: "en", value: "A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.", }, ], metrics: [ { cvssV3_0: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, }, ], providerMetadata: { dateUpdated: "2024-05-01T18:12:51.697Z", orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", shortName: "hackerone", }, references: [ { url: "https://hackerone.com/reports/2233486", }, { url: "https://security.netapp.com/advisory/ntap-20240315-0004/", }, { url: "http://www.openwall.com/lists/oss-security/2024/03/11/1", }, ], }, }, cveMetadata: { assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", assignerShortName: "hackerone", cveId: "CVE-2024-22019", datePublished: "2024-02-20T01:31:08.092Z", dateReserved: "2024-01-04T01:04:06.574Z", dateUpdated: "2025-02-13T17:33:26.049Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-37891
Vulnerability from cvelistv5
Published
2024-06-17 19:18
Modified
2024-08-22 18:03
Severity ?
EPSS score ?
Summary
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach. We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting the `Proxy-Authorization` header without using urllib3's built-in proxy support. 2. Not disabling HTTP redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to upgrade may use the `Proxy-Authorization` header with urllib3's `ProxyManager`, disable HTTP redirects using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as mitigations.
References
â–Ľ | URL | Tags |
---|---|---|
https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf | x_refsource_CONFIRM | |
https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270e | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-37891", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-06-18T13:49:45.845349Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-06-18T13:49:57.293Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-22T18:03:15.819Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf", tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf", }, { name: "https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270e", tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270e", }, { url: "https://www.vicarius.io/vsociety/posts/proxy-authorization-header-handling-vulnerability-in-urllib3-cve-2024-37891", }, { url: "https://security.netapp.com/advisory/ntap-20240822-0003/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "urllib3", vendor: "urllib3", versions: [ { status: "affected", version: "< 1.26.19", }, { status: "affected", version: ">= 2.0.0, < 2.2.2", }, ], }, ], descriptions: [ { lang: "en", value: " urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach. We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting the `Proxy-Authorization` header without using urllib3's built-in proxy support. 2. Not disabling HTTP redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to upgrade may use the `Proxy-Authorization` header with urllib3's `ProxyManager`, disable HTTP redirects using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as mitigations.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.4, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-669", description: "CWE-669: Incorrect Resource Transfer Between Spheres", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-06-17T19:18:32.574Z", orgId: "a0819718-46f1-4df5-94e2-005712e83aaa", shortName: "GitHub_M", }, references: [ { name: "https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf", tags: [ "x_refsource_CONFIRM", ], url: "https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf", }, { name: "https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270e", tags: [ "x_refsource_MISC", ], url: "https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270e", }, ], source: { advisory: "GHSA-34jh-p97f-mpxf", discovery: "UNKNOWN", }, title: "Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3", }, }, cveMetadata: { assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa", assignerShortName: "GitHub_M", cveId: "CVE-2024-37891", datePublished: "2024-06-17T19:18:32.574Z", dateReserved: "2024-06-10T19:54:41.361Z", dateUpdated: "2024-08-22T18:03:15.819Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-6232
Vulnerability from cvelistv5
Published
2024-09-03 12:29
Modified
2025-01-31 19:54
Severity ?
EPSS score ?
Summary
There is a MEDIUM severity vulnerability affecting CPython.
Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Python Software Foundation | CPython |
Version: 0 Version: 3.9.0 Version: 3.10.0 Version: 3.11.0 Version: 3.12.0 Version: 3.13.0a1 |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:python:cpython:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "cpython", vendor: "python", versions: [ { lessThan: "3.8.20", status: "affected", version: "0", versionType: "custom", }, { lessThan: "3.9.20", status: "affected", version: "3.9.0", versionType: "custom", }, { lessThan: "3.10.15", status: "affected", version: "3.10.0", versionType: "custom", }, { lessThan: "3.11.10", status: "affected", version: "3.11.0", versionType: "custom", }, { lessThan: "3.12.6", status: "affected", version: "3.12.0", versionType: "custom", }, { lessThan: "3.13.0rc2", status: "affected", version: "3.13.0a1", versionType: "custom", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2024-6232", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-04T15:24:31.176254Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-04T15:29:16.775Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-10-18T13:07:45.640Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { url: "http://www.openwall.com/lists/oss-security/2024/09/03/5", }, { url: "https://security.netapp.com/advisory/ntap-20241018-0007/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CPython", repo: "https://github.com/python/cpython", vendor: "Python Software Foundation", versions: [ { lessThan: "3.8.20", status: "affected", version: "0", versionType: "python", }, { lessThan: "3.9.20", status: "affected", version: "3.9.0", versionType: "python", }, { lessThan: "3.10.15", status: "affected", version: "3.10.0", versionType: "python", }, { lessThan: "3.11.10", status: "affected", version: "3.11.0", versionType: "python", }, { lessThan: "3.12.6", status: "affected", version: "3.12.0", versionType: "python", }, { lessThan: "3.13.0rc2", status: "affected", version: "3.13.0a1", versionType: "python", }, ], }, ], credits: [ { lang: "en", type: "reporter", value: "Elias Joakim Myllymäki", }, { lang: "en", type: "coordinator", value: "Seth Larson", }, { lang: "en", type: "remediation developer", value: "Seth Larson", }, { lang: "en", type: "remediation reviewer", value: "Gregory P. Smith", }, ], descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "<div>There is a MEDIUM severity vulnerability affecting CPython.<br></div><div><br></div><div>Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives. </div>", }, ], value: "There is a MEDIUM severity vulnerability affecting CPython.\n\n\n\n\n\nRegular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-1333", description: "CWE-1333 Inefficient Regular Expression Complexity", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-31T19:54:59.572Z", orgId: "28c92f92-d60d-412d-b760-e73465c3df22", shortName: "PSF", }, references: [ { tags: [ "patch", ], url: "https://github.com/python/cpython/pull/121286", }, { tags: [ "issue-tracking", ], url: "https://github.com/python/cpython/issues/121285", }, { tags: [ "vendor-advisory", ], url: "https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4", }, ], source: { discovery: "UNKNOWN", }, title: "Regular-expression DoS when parsing TarFile headers", x_generator: { engine: "Vulnogram 0.2.0", }, }, }, cveMetadata: { assignerOrgId: "28c92f92-d60d-412d-b760-e73465c3df22", assignerShortName: "PSF", cveId: "CVE-2024-6232", datePublished: "2024-09-03T12:29:00.102Z", dateReserved: "2024-06-20T21:01:55.524Z", dateUpdated: "2025-01-31T19:54:59.572Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-37372
Vulnerability from cvelistv5
Published
2025-01-09 00:33
Modified
2025-01-09 21:38
Severity ?
EPSS score ?
Summary
The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.
References
Impacted products
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-37372", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2025-01-09T21:37:14.611469Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-22", description: "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-09T21:38:02.105Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "node", vendor: "nodejs", versions: [ { lessThanOrEqual: "20.15.0", status: "affected", version: "20.15.0", versionType: "semver", }, { lessThanOrEqual: "22.4.0", status: "affected", version: "22.4.0", versionType: "semver", }, ], }, ], descriptions: [ { lang: "en", value: "The Permission Model assumes that any path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.", }, ], metrics: [ { cvssV3_0: { baseScore: 3.6, baseSeverity: "LOW", vectorString: "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", version: "3.0", }, }, ], providerMetadata: { dateUpdated: "2025-01-09T00:33:47.662Z", orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", shortName: "hackerone", }, references: [ { url: "http://www.openwall.com/lists/oss-security/2024/07/11/6", }, { url: "http://www.openwall.com/lists/oss-security/2024/07/19/3", }, ], }, }, cveMetadata: { assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", assignerShortName: "hackerone", cveId: "CVE-2024-37372", datePublished: "2025-01-09T00:33:47.662Z", dateReserved: "2024-06-07T01:04:06.869Z", dateUpdated: "2025-01-09T21:38:02.105Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-6119
Vulnerability from cvelistv5
Published
2024-09-03 15:58
Modified
2024-09-12 16:03
Severity ?
EPSS score ?
Summary
Issue summary: Applications performing certificate name checks (e.g., TLS
clients checking server certificates) may attempt to read an invalid memory
address resulting in abnormal termination of the application process.
Impact summary: Abnormal termination of an application can a cause a denial of
service.
Applications performing certificate name checks (e.g., TLS clients checking
server certificates) may attempt to read an invalid memory address when
comparing the expected name with an `otherName` subject alternative name of an
X.509 certificate. This may result in an exception that terminates the
application program.
Note that basic certificate chain validation (signatures, dates, ...) is not
affected, the denial of service can occur only when the application also
specifies an expected DNS name, Email address or IP address.
TLS servers rarely solicit client certificates, and even when they do, they
generally don't perform a name check against a reference identifier (expected
identity), but rather extract the presented identity after checking the
certificate chain. So TLS servers are generally not affected and the severity
of the issue is Moderate.
The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
References
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-09-12T16:03:01.704Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { url: "http://www.openwall.com/lists/oss-security/2024/09/03/4", }, { url: "https://lists.freebsd.org/archives/freebsd-security/2024-September/000303.html", }, { url: "https://security.netapp.com/advisory/ntap-20240912-0001/", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "openssl", vendor: "openssl", versions: [ { lessThan: "3.3.2", status: "affected", version: "3.3.0", versionType: "custom", }, { lessThan: "3.2.3", status: "affected", version: "3.2.0", versionType: "custom", }, { lessThan: "3.1.7", status: "affected", version: "3.1.0", versionType: "custom", }, { lessThan: "3.0.15", status: "affected", version: "3.0.0", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2024-6119", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-09-03T20:20:39.935362Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-09-03T20:25:47.056Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "OpenSSL", vendor: "OpenSSL", versions: [ { lessThan: "3.3.2", status: "affected", version: "3.3.0", versionType: "semver", }, { lessThan: "3.2.3", status: "affected", version: "3.2.0", versionType: "semver", }, { lessThan: "3.1.7", status: "affected", version: "3.1.0", versionType: "semver", }, { lessThan: "3.0.15", status: "affected", version: "3.0.0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "David Benjamin (Google)", }, { lang: "en", type: "remediation developer", value: "Viktor Dukhovni", }, ], datePublic: "2024-09-03T14:00:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "Issue summary: Applications performing certificate name checks (e.g., TLS<br>clients checking server certificates) may attempt to read an invalid memory<br>address resulting in abnormal termination of the application process.<br><br>Impact summary: Abnormal termination of an application can a cause a denial of<br>service.<br><br>Applications performing certificate name checks (e.g., TLS clients checking<br>server certificates) may attempt to read an invalid memory address when<br>comparing the expected name with an `otherName` subject alternative name of an<br>X.509 certificate. This may result in an exception that terminates the<br>application program.<br><br>Note that basic certificate chain validation (signatures, dates, ...) is not<br>affected, the denial of service can occur only when the application also<br>specifies an expected DNS name, Email address or IP address.<br><br>TLS servers rarely solicit client certificates, and even when they do, they<br>generally don't perform a name check against a reference identifier (expected<br>identity), but rather extract the presented identity after checking the<br>certificate chain. So TLS servers are generally not affected and the severity<br>of the issue is Moderate.<br><br>The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.", }, ], value: "Issue summary: Applications performing certificate name checks (e.g., TLS\nclients checking server certificates) may attempt to read an invalid memory\naddress resulting in abnormal termination of the application process.\n\nImpact summary: Abnormal termination of an application can a cause a denial of\nservice.\n\nApplications performing certificate name checks (e.g., TLS clients checking\nserver certificates) may attempt to read an invalid memory address when\ncomparing the expected name with an `otherName` subject alternative name of an\nX.509 certificate. This may result in an exception that terminates the\napplication program.\n\nNote that basic certificate chain validation (signatures, dates, ...) is not\naffected, the denial of service can occur only when the application also\nspecifies an expected DNS name, Email address or IP address.\n\nTLS servers rarely solicit client certificates, and even when they do, they\ngenerally don't perform a name check against a reference identifier (expected\nidentity), but rather extract the presented identity after checking the\ncertificate chain. So TLS servers are generally not affected and the severity\nof the issue is Moderate.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.", }, ], metrics: [ { format: "other", other: { content: { text: "Moderate", }, type: "https://www.openssl.org/policies/secpolicy.html", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-843", description: "CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-03T15:58:06.970Z", orgId: "3a12439a-ef3a-4c79-92e6-6081a721f1e5", shortName: "openssl", }, references: [ { name: "OpenSSL Advisory", tags: [ "vendor-advisory", ], url: "https://openssl-library.org/news/secadv/20240903.txt", }, { name: "3.3.2 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/7dfcee2cd2a63b2c64b9b4b0850be64cb695b0a0", }, { name: "3.2.3 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/05f360d9e849a1b277db628f1f13083a7f8dd04f", }, { name: "3.1.7 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/621f3729831b05ee828a3203eddb621d014ff2b2", }, { name: "3.0.15 git commit", tags: [ "patch", ], url: "https://github.com/openssl/openssl/commit/06d1dc3fa96a2ba5a3e22735a033012aadc9f0d6", }, ], source: { discovery: "UNKNOWN", }, title: "Possible denial of service in X.509 name checks", x_generator: { engine: "Vulnogram 0.2.0", }, }, }, cveMetadata: { assignerOrgId: "3a12439a-ef3a-4c79-92e6-6081a721f1e5", assignerShortName: "openssl", cveId: "CVE-2024-6119", datePublished: "2024-09-03T15:58:06.970Z", dateReserved: "2024-06-18T09:24:11.739Z", dateUpdated: "2024-09-12T16:03:01.704Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-4032
Vulnerability from cvelistv5
Published
2024-06-17 15:05
Modified
2024-09-17 15:55
Severity ?
EPSS score ?
Summary
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.
CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Python Software Foundation | CPython |
Version: 0 Version: 3.9.0 Version: 3.10.0 Version: 3.11.0 Version: 3.12.0 Version: 3.13.0a1 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-01T20:26:57.360Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "issue-tracking", "x_transferred", ], url: "https://github.com/python/cpython/issues/113171", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/pull/113179", }, { tags: [ "x_transferred", ], url: "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml", }, { tags: [ "x_transferred", ], url: "https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml", }, { tags: [ "vendor-advisory", "x_transferred", ], url: "https://mail.python.org/archives/list/security-announce@python.org/thread/NRUHDUS2IV2USIZM2CVMSFL6SCKU3RZA/", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/22adf29da8d99933ffed8647d3e0726edd16f7f8", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/40d75c2b7f5c67e254d0a025e0f2e2c7ada7f69f", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/895f7e2ac23eff4743143beef0f0c5ac71ea27d3", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/ba431579efdcbaed7a96f2ac4ea0775879a332fb", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/c62c9e518b784fe44432a3f4fc265fb95b651906", }, { tags: [ "patch", "x_transferred", ], url: "https://github.com/python/cpython/commit/f86b17ac511e68192ba71f27e752321a3252cee3", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/06/17/3", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20240726-0004/", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:python:cpython:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "cpython", vendor: "python", versions: [ { lessThan: "3.12.4", status: "affected", version: "0", versionType: "custom", }, { lessThan: "3.13.0a6", status: "affected", version: "3.13.0a1", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2024-4032", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-08-08T18:21:11.207929Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-697", description: "CWE-697 Incorrect Comparison", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-17T15:55:55.506Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CPython", repo: "https://github.com/python/cpython", vendor: "Python Software Foundation", versions: [ { lessThan: "3.8.20", status: "affected", version: "0", versionType: "python", }, { lessThan: "3.9.20", status: "affected", version: "3.9.0", versionType: "python", }, { lessThan: "3.10.15", status: "affected", version: "3.10.0", versionType: "python", }, { lessThan: "3.11.10", status: "affected", version: "3.11.0", versionType: "python", }, { lessThan: "3.12.4", status: "affected", version: "3.12.0", versionType: "python", }, { lessThan: "3.13.0a6", status: "affected", version: "3.13.0a1", versionType: "python", }, ], }, ], descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "<p><span style=\"background-color: transparent;\">The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.</span></p><p><span style=\"background-color: transparent;\">CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.</span></p>", }, ], value: "The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.\n\nCPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.", }, ], providerMetadata: { dateUpdated: "2024-09-07T02:44:42.321Z", orgId: "28c92f92-d60d-412d-b760-e73465c3df22", shortName: "PSF", }, references: [ { tags: [ "issue-tracking", ], url: "https://github.com/python/cpython/issues/113171", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/pull/113179", }, { url: "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml", }, { url: "https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml", }, { tags: [ "vendor-advisory", ], url: "https://mail.python.org/archives/list/security-announce@python.org/thread/NRUHDUS2IV2USIZM2CVMSFL6SCKU3RZA/", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/22adf29da8d99933ffed8647d3e0726edd16f7f8", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/40d75c2b7f5c67e254d0a025e0f2e2c7ada7f69f", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/895f7e2ac23eff4743143beef0f0c5ac71ea27d3", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/ba431579efdcbaed7a96f2ac4ea0775879a332fb", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/c62c9e518b784fe44432a3f4fc265fb95b651906", }, { tags: [ "patch", ], url: "https://github.com/python/cpython/commit/f86b17ac511e68192ba71f27e752321a3252cee3", }, { url: "http://www.openwall.com/lists/oss-security/2024/06/17/3", }, { url: "https://security.netapp.com/advisory/ntap-20240726-0004/", }, ], source: { discovery: "UNKNOWN", }, title: "Incorrect IPv4 and IPv6 private ranges", x_generator: { engine: "Vulnogram 0.2.0", }, }, }, cveMetadata: { assignerOrgId: "28c92f92-d60d-412d-b760-e73465c3df22", assignerShortName: "PSF", cveId: "CVE-2024-4032", datePublished: "2024-06-17T15:05:58.827Z", dateReserved: "2024-04-22T17:15:47.895Z", dateUpdated: "2024-09-17T15:55:55.506Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-38999
Vulnerability from cvelistv5
Published
2024-07-01 00:00
Modified
2024-08-02 04:19
Severity ?
EPSS score ?
Summary
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
References
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:jrburke:requirejs:2.3.6:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "requirejs", vendor: "jrburke", versions: [ { status: "affected", version: "2.3.6", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 10, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2024-38999", options: [ { Exploitation: "poc", }, { Automatable: "yes", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-07-09T15:59:34.204957Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-1321", description: "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-07-09T16:00:29.785Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T04:19:20.589Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], descriptions: [ { lang: "en", value: "jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2024-07-01T12:49:23.049244", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { url: "https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a", }, ], }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2024-38999", datePublished: "2024-07-01T00:00:00", dateReserved: "2024-06-21T00:00:00", dateUpdated: "2024-08-02T04:19:20.589Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.