Jackson Dataformats Binary: CVE-2024-10455/10456/10457 DoS Vulnerability Advisory

Vulnerability Overview In the project, several security-related vulnerabilities exist, primarily involving insufficient input data validation, which can lead to Denial of Service (DoS) attacks or data corruption. Affected Scope Protobuf Module: - Vulnerability ID: CVE-2024-10457 - Issue Description: does not correctly validate length values when processing length-prefixed data, potentially leading to Denial of Service attacks. - Remediation: Improved length validation logic. CBOR Module: - Vulnerability ID: CVE-2024-10455 - Issue Description: does not correctly validate string lengths, potentially leading to Denial of Service attacks. - Remediation: Improved length validation logic. Smile Module: - Vulnerability ID: CVE-2024-10456 - Issue Description: does not correctly validate string lengths, potentially leading to Denial of Service attacks. - Remediation: Improved length validation logic. Remediation Protobuf Module: - Fix Code: CBOR Module: - Fix Code: Smile Module: - Fix Code: Additional Information Maintainers: - Tyler Gregg (@tggregg) - Tatu Saloranta (@cowtowncoder) Version Information: - Current Version: 2.18.12 (not yet released) - Previous Version: 2.18.11 (released September 20, 2024) Contributors: - Björn Fanning - Claude Code - @tongmuo - @Yohel K - @davidh - @Knut W - @Rafal H - @Michal F - @Joachim L - @Robert N - @Yann V - @Florian H - @Mgoertzen Summary This page details security vulnerabilities across several modules in the project and their respective remediation strategies, emphasizing the importance of input validation to prevent potential Denial of Service attacks.

Goal Reached Thanks to every supporter — we hit 100%!

Jackson Dataformats Binary: CVE-2024-10455/10456/10457 DoS Vulnerability Advisory

More from this source