Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-38354 State: PUBLISHED Published: 2024-07-10T19:49:55.838Z Last Updated: 2024-08-02T04:04:25.208Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: hackmdio Products: codimd Problem Types: CWE-79 Description: CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe `HTML` tags with an improperly sanitized `name` attribute. This vulnerability enables attackers to perform cross-site scripting (XSS) attacks via DOM clobbering. This vulnerability is fixed in 2.5.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com
d in 2.5.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/hackmdio/codimd/security/advisories/GHSA-22jv-vch8-2vp9
CVE ID: CVE-2024-38355 State: PUBLISHED Published: 2024-06-19T19:48:50.193Z Last Updated: 2024-09-03T20:35:40.515Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: socketio Products: socket.io Problem Types: CWE-20, CWE-754 Description: Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to u
released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj - https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115 - https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c
CVE ID: CVE-2024-38356 State: PUBLISHED Published: 2024-06-19T20:03:47.923Z Last Updated: 2024-08-02T04:04:25.245Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: tinymce Products: tinymce Problem Types: CWE-79 Description: TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the `noneditable_regexp` option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the `none
erability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the `noneditable_regexp` option, any content within an attribute is properly verified to match the configured regular expression before being added. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tinymce/tinymce/security/advisories/GHSA-9hcv-j9pv-qmph - https://github.com/tinymce/tinymce/commit/5acb741665a98e83d62b91713c800abbff43b00d - https://owasp.org/www-community/attacks/xss - https://www.tiny.cloud/docs/tinymce/6/6.8.4-release-notes
800abbff43b00d - https://owasp.org/www-community/attacks/xss - https://www.tiny.cloud/docs/tinymce/6/6.8.4-release-notes/#overview - https://www.tiny.cloud/docs/tinymce/7/7.2-release-notes/#overview
CVE ID: CVE-2024-38357 State: PUBLISHED Published: 2024-06-19T20:03:49.806Z Last Updated: 2024-08-02T04:04:25.258Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: tinymce Products: tinymce Problem Types: CWE-79 Description: TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users a
2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tinymce/tinymce/security/advisories/GHSA-w9jx-4g6g-rp7x - https://github.com/tinymce/tinymce/commit/5acb741665a98e83d62b91713c800abbff43b00d - https://owasp.org/www-community/attacks/xss - https://www.tiny.cloud/docs/tinymce/6/6.8.4-release-notes/#overview - https://www.tiny.cloud/docs/tinymce/7/7.2-release-notes/#overview
CVE ID: CVE-2024-38358 State: PUBLISHED Published: 2024-06-19T19:55:26.111Z Last Updated: 2024-08-02T04:04:25.282Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: wasmerio Products: wasmer Problem Types: CWE-22 Description: Wasmer is a web assembly (wasm) Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both `oflags::creat` and `rights::fd_write`. Programs can also crash the runtime by creating a symlink pointing outside with `path_symlink` and `path_open`ing the link. This issue has been addressed in commit `b9483d022` w
pointing outside with `path_symlink` and `path_open`ing the link. This issue has been addressed in commit `b9483d022` which has been included in release version 4.3.2. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/wasmerio/wasmer/security/advisories/GHSA-55f3-3qvg-8pv5 - https://github.com/wasmerio/wasmer/commit/b9483d022c602b994103f78ecfe46f017f8ac662
CVE ID: CVE-2024-38359 State: PUBLISHED Published: 2024-06-20T22:16:00.428Z Last Updated: 2024-08-02T04:04:25.238Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: lightningnetwork Products: lnd Problem Types: CWE-20 Description: The Lightning Network Daemon (lnd) - is a complete implementation of a Lightning Network node. A parsing vulnerability in lnd's onion processing logic and lead to a DoS vector due to excessive memory allocation. The issue was patched in lnd v0.17.0. Users should update to a version > v0.17.0 to be protected. Users unable to upgrade may set the `--rejecthtlc` CLI flag and also disable forwarding on channels via the `UpdateChanPolicyCo
nable to upgrade may set the `--rejecthtlc` CLI flag and also disable forwarding on channels via the `UpdateChanPolicyCommand`, or disable listening on a public network interface via the `--nolisten` flag as a mitigation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/lightningnetwork/lnd/security/advisories/GHSA-9gxx-58q6-42p7 - https://delvingbitcoin.org/t/dos-disclosure-lnd-onion-bomb/979 - https://github.com/lightningnetwork/lnd/releases/tag/v0.17.0-beta - https://lightning.network - https://morehouse.github.io/lightning/lnd-onion-bomb
CVE ID: CVE-2024-38360 State: PUBLISHED Published: 2024-07-15T19:43:04.811Z Last Updated: 2024-08-02T04:04:25.127Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: discourse Products: discourse Problem Types: CWE-400 Description: Discourse is an open source platform for community discussion. In affected versions by creating replacement words with an almost unlimited number of characters, a moderator can reduce the availability of a Discourse instance. This issue has been addressed in stable version 3.2.3 and in current betas. Users are advised to upgrade. Users unable to upgrade may manually remove the long watched words either via SQL or Rails console. Addit
ed to upgrade. Users unable to upgrade may manually remove the long watched words either via SQL or Rails console. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-68pm-hm8x-pq2p - https://github.com/discourse/discourse/commit/7b53e610c17e38be982dffefa4e5b5a709a3b990
CVE ID: CVE-2024-38361 State: PUBLISHED Published: 2024-06-20T22:18:35.552Z Last Updated: 2024-08-02T04:04:25.268Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: authzed Products: spicedb Problem Types: CWE-281 Description: Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected. If the resource exists under *multiple* folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the excl
access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that *all* the folders in which the user is a member be returned. Permission is returned as `NO_PERMISSION` when `PERMISSION` is expected on the `CheckPermission` API. This issue has been addressed in version 1.33.1. All users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/authzed/spicedb/security/advisories/GHSA-grjv-gjgr-66g2 - https://github.com/authzed/spicedb/commit/ecef31d2b266fde17eb2c3415e2ec4ceff96fbeb
CVE ID: CVE-2024-38363 State: PUBLISHED Published: 2024-07-09T14:10:47.792Z Last Updated: 2024-08-02T04:04:25.126Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: airbytehq Products: airbyte Problem Types: CWE-1336 Description: Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new connectors. Sensitive information, such as credentials, could be exposed if a user tested a new connector on a compromised instance. The connection
ation, such as credentials, could be exposed if a user tested a new connector on a compromised instance. The connection builder does not have access to any data processes. This vulnerability is fixed in 0.62.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/airbytehq/airbyte/security/advisories/GHSA-4j3c-fgvx-xgqq
CVE ID: CVE-2024-38364 State: PUBLISHED Published: 2024-06-25T23:45:57.493Z Last Updated: 2024-08-02T04:04:25.278Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: DSpace Products: DSpace Problem Types: CWE-79 Description: DSpace is an open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable access to digital resources. In DSpace 7.0 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user's browser may execute any embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack. This vulnerability has been patched in version
that embedded JavaScript is malicious, there is a risk of an XSS attack. This vulnerability has been patched in version 7.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/DSpace/DSpace/security/advisories/GHSA-94cc-xjxr-pwvf - https://github.com/DSpace/DSpace/pull/8891 - https://github.com/DSpace/DSpace/pull/9638 - https://github.com/DSpace/DSpace/commit/f1059b4340857cca3dc4c45b1ebbadce6bb61c0b
CVE ID: CVE-2024-38365 State: PUBLISHED Published: 2024-10-11T19:32:12.348Z Last Updated: 2024-10-11T19:48:30.393Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: btcsuite Products: btcd Problem Types: CWE-670 Description: btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). This consensus failure can be leveraged to cause a chain s
ccepting an invalid Bitcoin block (or rejecting a valid one). This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn't return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a "standard" Bitcoin transaction, that is a transaction which gets relayed through the P2P network before i
triggered by a "standard" Bitcoin transaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block. `removeOpcodeByData(script []byte, dataToRemove []byte)` removes any data pushes from `script` that contain `dataToRemove`. However, `FindAndDelete` only removes exact matches. So for example, with `script = "<data> <data||foo>"` and `dataToRemove = "data"` btcd will remove both data pushes but Bitcoin Core's `FindAndDelete` only removes the first `<data>` push. This has been patched in btcd version v0.24.2. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
vised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8 - https://github.com/btcsuite/btcd/commit/04469e600e7d4a58881e2e5447d19024e49800f5 - https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184 - https://github.com/btcsuite/btcd/releases/tag/v0.24.2
CVE ID: CVE-2024-38366 State: PUBLISHED Published: 2024-07-01T20:42:38.281Z Last Updated: 2024-08-02T04:04:25.256Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: CocoaPods Products: CocoaPods Problem Types: CWE-74 Description: trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX records validity. It works via an DNS MX. This lookup could be manipulated to also execute a command on the trunk server, effectively giving root access to the server and the infra
be manipulated to also execute a command on the trunk server, effectively giving root access to the server and the infrastructure. This issue was patched server-side with commit 001cc3a430e75a16307f5fd6cdff1363ad2f40f3 in September 2023. This RCE triggered a full user-session reset, as an attacker could have used this method to write to any Podspec in trunk. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-x2x4-g675-qg7c - https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023 - https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#2-remote-code-execution-on-
2023 - https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#2-remote-code-execution-on-the-cocoapods-trunk-server
CVE ID: CVE-2024-38367 State: PUBLISHED Published: 2024-07-01T20:48:06.861Z Last Updated: 2024-08-19T14:50:18.770Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:H) Vendors: CocoaPods Products: CocoaPods Problem Types: CWE-488 Description: trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim’s session will result in a full takeover of the CocoaPods trunk account. The threat actor could manipulate their pod specifications, disrupt the distribution of legitimate libraries, or
ccount. The threat actor could manipulate their pod specifications, disrupt the distribution of legitimate libraries, or cause widespread disruption within the CocoaPods ecosystem. This was patched server-side with commit d4fa66f49cedab449af9a56a21ab40697b9f7b97 in October 2023. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-52gf-m7v9-m333 - https://github.com/CocoaPods/trunk.cocoapods.org/commit/d4fa66f49cedab449af9a56a21ab40697b9f7b97 - https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023 - https://evasec.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#vulnerability-3-a
oaPods-Trunk-RCEs-2023 - https://evasec.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#vulnerability-3-achieving-zero-click-account-takeover-by-defeating-email-security-boundaries
CVE ID: CVE-2024-38368 State: PUBLISHED Published: 2024-07-01T21:05:48.031Z Last Updated: 2024-08-02T04:04:25.189Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L) Vendors: CocoaPods Products: CocoaPods Problem Types: CWE-668 Description: trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. If the pods had never been claimed then it was still possible to do so. It was also possible to have all owners removed from a pod, and that made the pod available for the same claiming system. This was patched server-side in commit 71be5440906b6
pod, and that made the pod available for the same claiming system. This was patched server-side in commit 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 in September 2023. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-j483-qm5c-7hqx - https://github.com/CocoaPods/trunk.cocoapods.org/commit/71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 - https://blog.cocoapods.org/Claim-Your-Pods - https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023 - https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#1-taking-unauthorized-ownership-over-orphaned-pods
CVE ID: CVE-2024-38369 State: PUBLISHED Published: 2024-06-24T16:39:37.695Z Last Updated: 2024-08-02T04:04:25.248Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-863 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of a document included using `{{include reference="targetdocument"/}}` is executed with the right of the includer and not with the right of its author. This means that any user able to modify the target document can impersonate the author of the content which used the `include` macro. This vulnerability has been patc
rget document can impersonate the author of the content which used the `include` macro. This vulnerability has been patched in XWiki 15.0 RC1 by making the default behavior safe. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qcj3-wpgm-qpxh
CVE ID: CVE-2024-38370 State: PUBLISHED Published: 2024-11-15T21:12:56.606Z Last Updated: 2024-11-18T19:02:59.188Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-285 Description: GLPI is a free asset and IT management software package. Starting in 9.2.0 and prior to 11.0.0, it is possible to download a document from the API without appropriate rights. Upgrade to 10.0.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-xrm2-m72w-w4x4
CVE ID: CVE-2024-38371 State: PUBLISHED Published: 2024-06-28T17:58:48.169Z Last Updated: 2024-08-02T04:04:25.257Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: goauthentik Products: authentik Problem Types: CWE-284, CWE-285 Description: authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This issue has been patched in version(s) 2024.6.0, 2024.2.4 and 2024.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Ref
sion(s) 2024.6.0, 2024.2.4 and 2024.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/goauthentik/authentik/security/advisories/GHSA-jq3m-37m7-gp45 - https://github.com/goauthentik/authentik/releases/tag/version%2F2024.2.4 - https://github.com/goauthentik/authentik/releases/tag/version%2F2024.4.3 - https://github.com/goauthentik/authentik/releases/tag/version%2F2024.6.0
CVE ID: CVE-2024-38372 State: PUBLISHED Published: 2024-07-08T20:25:59.111Z Last Updated: 2024-08-28T15:02:48.392Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: nodejs Products: undici Problem Types: CWE-201 Description: Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq - https://github.com/nodejs/undici/i
erences: - https://github.com/nodejs/undici/security/advisories/GHSA-3g92-w8c5-73pq - https://github.com/nodejs/undici/issues/3328 - https://github.com/nodejs/undici/issues/3337 - https://github.com/nodejs/undici/pull/3338 - https://github.com/nodejs/undici/commit/f979ec3204ca489abf30e7d20e9fee9ea7711d36
CVE ID: CVE-2024-38373 State: PUBLISHED Published: 2024-06-24T16:23:00.162Z Last Updated: 2024-08-02T04:04:25.337Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H) Vendors: FreeRTOS Products: FreeRTOS-Plus-TCP Problem Types: CWE-126 Description: FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Response Parser when parsing domain names in a DNS response. A carefully crafted DNS response with domain name length value greater than the actual domain name length, could cause the parser to read beyond the DNS response buffer. This issue affects applications using DNS fu
name length, could cause the parser to read beyond the DNS response buffer. This issue affects applications using DNS functionality of the FreeRTOS-Plus-TCP stack. Applications that do not use DNS functionality are not affected, even when the DNS functionality is enabled. This vulnerability has been patched in version 4.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-ppcp-rg65-58mv - https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.1.1