PT-2024-19663 · Apfloat · Apfloat

Published 2024-04-08 · Updated 2024-08-20 · CVE-2024-23084

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apfloat version 1.10.1

Description The issue is related to an ArrayIndexOutOfBoundsException in the org.apfloat.internal.DoubleCRTMath::add(double[], double[]) component. However, it is noted that the existence of this vulnerability is disputed by multiple third parties due to potentially insufficient evidence. The vulnerability is related to the add function, which takes two double[] parameters.

Recommendations For Apfloat version 1.10.1, as a temporary workaround, consider disabling the add function in the org.apfloat.internal.DoubleCRTMath component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2024-23084

Affected Products

Apfloat

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-23084 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23084 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-23084 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-23084 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-23084 · Vendor Advisory
• https://github.com/mtommila/apfloat · Note
• https://gist.github.com/LLM4IG/5b7dd0a87db14d9c95d4c0ea62e0195b · Note
• https://twitter.com/CVEnew/status/1777465846245531998 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1777494197924200468 · Twitter Post
• https://t.me/cvenotify/76101 · Telegram Post
• https://t.me/cvenotify/91313 · Telegram Post
• http://apfloat.com · Note