PT-2024-19661 · Unknown · Threeten Backport

Published 2024-04-08 · Updated 2024-08-01 · CVE-2024-23082

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions ThreeTen Backport version 1.6.8

Description The issue is related to an integer overflow in the org.threeten.bp.format.DateTimeFormatter::parse(CharSequence, ParsePosition) component. However, it is noted that the existence of this issue is disputed by multiple third parties, suggesting that the evidence may not be sufficient to confirm the vulnerability.

Recommendations For ThreeTen Backport version 1.6.8, consider restricting the use of the org.threeten.bp.format.DateTimeFormatter::parse(CharSequence, ParsePosition) component until further clarification on the issue is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2024-23082

Affected Products

Threeten Backport

References · 13

• https://osv.dev/vulnerability/CVE-2024-23082 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-23082 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-23082 · Security Note
• https://ubuntu.com/security/CVE-2024-23082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23082 · Security Note
• https://github.com/ThreeTen/threetenbp · Note
• https://t.me/cvenotify/76073 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1777440686029013172 · Twitter Post
• https://t.me/cvenotify/76460 · Telegram Post
• http://threeten.com · Note
• https://t.me/cvenotify/85271 · Telegram Post
• https://twitter.com/CVEnew/status/1777401320942526924 · Twitter Post
• https://gist.github.com/LLM4IG/d2618f5f4e5ac37eb75cff5617e58b90 · Note