CVE-2024-23684

Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use of this library, this may be a remote attacker.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/advisories/GHSA-fj2w-wfgv-mwq6	Mitigation Third Party Advisory
https://github.com/peteroupc/CBOR-Java/security/advisories/GHSA-fj2w-wfgv-mwq6	Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-fj2w-wfgv-mwq6	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:peteroupc:cbor:*:*:*:*:*:.net:*:*

History

26 Jan 2024, 18:06

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
CPE		cpe:2.3:a:peteroupc:cbor::::::.net::*
CWE		CWE-407
References	~~() https://github.com/advisories/GHSA-fj2w-wfgv-mwq6 -~~	() https://github.com/advisories/GHSA-fj2w-wfgv-mwq6 - Mitigation, Third Party Advisory
References	~~() https://github.com/peteroupc/CBOR-Java/security/advisories/GHSA-fj2w-wfgv-mwq6 -~~	() https://github.com/peteroupc/CBOR-Java/security/advisories/GHSA-fj2w-wfgv-mwq6 - Vendor Advisory
References	~~() https://vulncheck.com/advisories/vc-advisory-GHSA-fj2w-wfgv-mwq6 -~~	() https://vulncheck.com/advisories/vc-advisory-GHSA-fj2w-wfgv-mwq6 - Third Party Advisory

19 Jan 2024, 22:52

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-19 21:15

Updated : 2024-02-05 00:22

NVD link : CVE-2024-23684

Mitre link : CVE-2024-23684

CVE.ORG link : CVE-2024-23684

JSON object : View

Products Affected

peteroupc

cbor

CWE

CWE-407

Inefficient Algorithmic Complexity

{"id": "CVE-2024-23684", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-01-19T21:15:10.387", "references": [{"url": "https://github.com/advisories/GHSA-fj2w-wfgv-mwq6", "tags": ["Mitigation", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/peteroupc/CBOR-Java/security/advisories/GHSA-fj2w-wfgv-mwq6", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://vulncheck.com/advisories/vc-advisory-GHSA-fj2w-wfgv-mwq6", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-407"}]}, {"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-407"}]}], "descriptions": [{"lang": "en", "value": "Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use of this library, this may be a remote attacker.\n\n"}, {"lang": "es", "value": "La complejidad algor\u00edtmica ineficiente en la funci\u00f3n DecodeFromBytes en com.upokecenter.cbor la implementaci\u00f3n Java de Concise Binary Object Representation (CBOR) versiones 4.0.0 a 4.5.1 permite a un atacante provocar una denegaci\u00f3n de servicio al pasar una entrada manipulada con fines malintencionados. Dependiendo del uso de esta librer\u00eda por parte de una aplicaci\u00f3n, este puede ser un atacante remoto."}], "lastModified": "2024-01-26T18:06:27.610", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:peteroupc:cbor:*:*:*:*:*:.net:*:*", "vulnerable": true, "matchCriteriaId": "1ACE4764-C56D-427B-99DA-52922CA6C062", "versionEndExcluding": "4.5.1", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}