Skip to content

Latest commit

 

History

History
54 lines (38 loc) · 1.89 KB

cve-2024-45491.md

File metadata and controls

54 lines (38 loc) · 1.89 KB
sidebar_label title description hide_table_of_contents sidebar_class_name toc_max_heading_level tags
CVE-2024-45491
CVE-2024-45491
Lifecycle of CVE-2024-45491
true
hide-from-sidebar
2
security
cve

CVE Details

CVE-2024-45491

Last Update

11/7/24

NIST CVE Summary

An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

Our Official Summary

This CVE identifies an integer overflow vulnerability found in libexpat versions prior to 2.6.3, specifically in the dtdCopy function of xmlparse.c on 32-bit platforms. This vulnerability can be exploited over a network without user interaction and has very low attack complexity. Not all of the images affected use the specific function affected. Exploiting this vulnerable library will require a user to compromise the containers and gain privileged access. Fix is available in libexpat versions > 2.6.3. Investigating upgrading this library within the affected images.

CVE Severity

9.8

Status

Ongoing

Affected Products & Versions

  • Palette VerteX airgap 4.4.14, 4.4.18, 4.5.3
  • Palette Enterprise airgap 4.4.18, 4.5.3, 4.5.8
  • Palette VerteX 4.5.3
  • Palette Enterprise 4.5.3, 4.5.8

Revision History

  • 1.0 08/16/2024 Initial Publication
  • 2.0 08/17/2024 Added Palette VerteX airgap 4.4.14 to Affected Products
  • 3.0 09/17/2024 Added Palette VerteX airgap 4.4.18 & Palette Enterprise airgap 4.4.18 to Affected Products
  • 4.0 10/10/2024 Added Palette VerteX airgap 4.5.3 & Palette Enterprise airgap 4.5.3 to Affected Products
  • 5.0 10/14/2024 Added Palette Enterprise & Palette VerteX 4.5.3 to Affected Products
  • 6.0 11/7/2024 Added Palette Enterprise & Palette Enterprise airgap 4.5.8 to Affected Products