CVE-2024-21646

Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Azure/azure-uamqp-c/commit/12ddb3a31a5a97f55b06fa5d74c59a1d84ad78fe	Patch
https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-j29m-p99g-7hpv	Vendor Advisory
https://github.com/Azure/azure-uamqp-c/commit/12ddb3a31a5a97f55b06fa5d74c59a1d84ad78fe	Patch
https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-j29m-p99g-7hpv	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:azure_uamqp:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:54

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-09 01:15

Updated : 2024-11-21 08:54

NVD link : CVE-2024-21646

Mitre link : CVE-2024-21646

CVE.ORG link : CVE-2024-21646

JSON object : View

Products Affected

microsoft

azure_uamqp

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2024-21646", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-01-09T01:15:38.937", "references": [{"url": "https://github.com/Azure/azure-uamqp-c/commit/12ddb3a31a5a97f55b06fa5d74c59a1d84ad78fe", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-j29m-p99g-7hpv", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Azure/azure-uamqp-c/commit/12ddb3a31a5a97f55b06fa5d74c59a1d84ad78fe", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-j29m-p99g-7hpv", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01."}, {"lang": "es", "value": "Azure uAMQP es una librer\u00eda C de uso general para AMQP 1.0. Varios clientes utilizan la librer\u00eda UAMQP para implementar la comunicaci\u00f3n del protocolo AMQP. Cuando los clientes que utilizan esta librer\u00eda reciben datos de tipo binario manipulados, puede producirse un desbordamiento de enteros o un problema de seguridad de la memoria que puede provocar la ejecuci\u00f3n remota de c\u00f3digo. Esta vulnerabilidad se solucion\u00f3 en la versi\u00f3n 2024-01-01."}], "lastModified": "2024-11-21T08:54:47.650", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:azure_uamqp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7BC0B9B-7E26-4F62-88D1-D076EB37050C", "versionEndExcluding": "2024-01-01"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}