PT-2024-27243 · Unknown · Ada Web Server

Published 2024-08-13 · Updated 2024-08-17 · CVE-2024-37015

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ada Web Server version 20.0

Description An issue was discovered in Ada Web Server when configured to use SSL, which is not the default setting. The SSL/TLS used to establish connections to external services is done without proper hostname validation. This is exploitable by man-in-the-middle attackers.

Recommendations For Ada Web Server version 20.0, consider disabling SSL/TLS connections to external services until a patch is available. As a temporary workaround, restrict the use of SSL/TLS connections to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-297

Related Identifiers

CVE-2024-37015

Affected Products

Ada Web Server

References · 12

• https://osv.dev/vulnerability/UBUNTU-CVE-2024-37015 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-37015 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-37015 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37015 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-37015 · Vendor Advisory
• https://github.com/AdaCore/aws · Note
• https://twitter.com/PorsilapongoCl/status/1823413038835237191 · Twitter Post
• https://docs.adacore.com/corp/security-advisories/SEC.AWS-0031-v2.pdf · Note
• https://twitter.com/CVEnew/status/1823411956096942276 · Twitter Post
• https://t.me/cvedetector/3040 · Telegram Post
• https://twitter.com/cracbot/status/1825050111338238143 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1823430622569767044 · Twitter Post