CVE-2024-26134

Katalog CVE

CVSS 7.5 · High EPSS 1,2%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada agronholm cbor2, fedoraproject fedora. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.

Rincian

Terbit di NVD

19 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m exploit · advisory vendor
• https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df patch
• https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542 product
• https://github.com/agronholm/cbor2/pull/204 issue tracking
• https://github.com/agronholm/cbor2/releases/tag/5.6.2 release notes
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHM... mailing list
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37... mailing list
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCS... mailing list