PT-2024-19660 · Unknown · Threeten Backport

Published 2024-04-08 · Updated 2024-08-01 · CVE-2024-23081

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions ThreeTen Backport version 1.6.8

Description A NullPointerException was discovered in the component org.threeten.bp.LocalDate::compareTo(ChronoLocalDate). However, the existence of this issue is disputed by multiple third parties due to potentially insufficient evidence. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.

Recommendations For ThreeTen Backport version 1.6.8, consider temporarily disabling or restricting the use of the compareTo(ChronoLocalDate) function in the org.threeten.bp.LocalDate component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2024-23081

Affected Products

Threeten Backport

References · 12

• https://ubuntu.com/security/CVE-2024-23081 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-23081 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23081 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23081 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-23081 · Security Note
• https://github.com/ThreeTen/threetenbp · Note
• https://twitter.com/CVEnew/status/1777465845142409619 · Twitter Post
• https://t.me/cvenotify/85272 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1777493944743407982 · Twitter Post
• http://threeten.com · Note
• https://gist.github.com/LLM4IG/3cc9183dcd887020368a0bafeafec5e3 · Note
• https://t.me/cvenotify/76100 · Telegram Post