High severity · published Jan 3, 2024
CVE-2024-21909
PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability
7.5
CVSS
1.1%
EPSS
No
On KEV
Description
PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of
service vulnerability. An attacker may trigger the denial of service
condition by providing crafted data to the DecodeFromBytes or other
decoding mechanisms in PeterO.Cbor. Depending on the usage of the
library, an unauthenticated and remote attacker may be able to cause the
denial of service condition.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CB
Cbor · Peteroupc
4.0.0 before 4.5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21909
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21909
Third Party Advisory
https://github.com/advisories/GHSA-6r92-cgxc-r5fg
Patch
https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95
Release Notes
https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1
Third Party Advisory
https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg
Third Party Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg
More from Cbor
7.5
CVE-2024-23684
Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1…