CVE-2024-27319

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-27319
Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one string copy.

4.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/onnx/onnx/commit/08a399ba75a805b7813ab8936b91d0e274b08287 Patch
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL/ Third Party Advisory
https://github.com/onnx/onnx/commit/08a399ba75a805b7813ab8936b91d0e274b08287 Patch
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxfoundation:onnx:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
History

22 Jan 2025, 14:26

Type Values Removed Values Added
CPE cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:a:linuxfoundation:onnx:*:*:*:*:*:*:*:*
First Time Fedoraproject fedora
Fedoraproject
Linuxfoundation onnx
Linuxfoundation
References () https://github.com/onnx/onnx/commit/08a399ba75a805b7813ab8936b91d0e274b08287 - () https://github.com/onnx/onnx/commit/08a399ba75a805b7813ab8936b91d0e274b08287 - Patch
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY/ - Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL/ - Third Party Advisory

21 Nov 2024, 09:04

Type Values Removed Values Added
References () https://github.com/onnx/onnx/commit/08a399ba75a805b7813ab8936b91d0e274b08287 - () https://github.com/onnx/onnx/commit/08a399ba75a805b7813ab8936b91d0e274b08287 -
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY/ -
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL/ -

30 Mar 2024, 02:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL/ -

29 Mar 2024, 03:15

Type Values Removed Values Added
Summary
  • (es) Las versiones del paquete onnx anteriores a la 1.15.0 inclusive son vulnerables a la lectura fuera de los límites, ya que las funciones ONNX_ASSERT y ONNX_ASSERTM tienen una copia desactivada por una cadena.
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY/ -

23 Feb 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-23 18:15

Updated : 2025-01-22 14:26

NVD link : CVE-2024-27319

Mitre link : CVE-2024-27319

CVE.ORG link : CVE-2024-27319

JSON object : View

Products Affected

linuxfoundation

  • onnx

fedoraproject

  • fedora
CWE
CWE-125

Out-of-bounds Read