VulnerabilityAnalyzed
CVE-2024-26134
Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.
HIGH 7.5EPSS 1.18%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.18%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.18% probability · 66th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-120
- Affected
- agronholm/cbor2 · fedoraproject/fedora
- Source
- security-advisories@github.com
References
- https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542Product
- https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873dfPatch
- https://github.com/agronholm/cbor2/pull/204Issue Tracking
- https://github.com/agronholm/cbor2/releases/tag/5.6.2Release Notes
- https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7mExploit, Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/Mailing List
- https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542Product
- https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873dfPatch
- https://github.com/agronholm/cbor2/pull/204Issue Tracking
- https://github.com/agronholm/cbor2/releases/tag/5.6.2Release Notes
- https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7mExploit, Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/Mailing List
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.