PT-2021-24042 · Croatia Control · Asterix

Published 2021-11-22 · Updated 2022-05-24 · CVE-2021-44144

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Croatia Control Asterix version 2.8.1

Description: The issue is a heap-based buffer over-read. Additional details about this issue are expected to be disclosed at a later date. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

Recommendations: For version 2.8.1, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2021-44144

GHSA-6MMF-V5Q7-VW2W

PYSEC-2021-860

Affected Products

Asterix

References · 13

• https://github.com/CroatiaControlLtd/asterix/issues/183 · Patch
• https://osv.dev/vulnerability/GHSA-6mmf-v5q7-vw2w · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44144 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44144 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/asterix-decoder/PYSEC-2021-860.yaml · Note
• https://github.com/croatiacontrolltd/asterix/commit/3f765d387d239ccc44e278a2ffa600fb6a6587f9 · Note
• https://github.com/CroatiaControlLtd/asterix/blob/daf33de522d1cdab0e941c025b89e18a0d4d42c6/README.md?plain=1#L7 · Note
• https://github.com/CroatiaControlLtd/asterix · Note
• https://github.com/CroatiaControlLtd/asterix/commit/3f765d387d239ccc44e278a2ffa600fb6a6587f9 · Note
• https://t.me/cvenotify/23632 · Telegram Post
• https://web.archive.org/web/20221207104133/https://huntr.dev/bounties/1-other-CroatiaControlLtd/asterix · Note
• https://t.me/cibsecurity/32826 · Telegram Post