PT-2024-27467 · Cratedb · Cratedb

Baurzhan Sakhariev · Published 2024-06-13 · Updated 2024-06-13 · CVE-2024-37309

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions CrateDB versions prior to 5.7.2

Description A high-risk issue has been identified in the TLS endpoint, where client-initiated renegotiation is permitted, allowing an attacker to exploit this feature and repeatedly request renegotiation of security parameters during an ongoing TLS session. This can lead to excessive consumption of CPU resources, resulting in potential server overload and service disruption. The issue was confirmed using an openssl client, where the command R initiates renegotiation, followed by the server confirming with RENEGOTIATING. This allows an attacker to perform a denial of service attack by exhausting server CPU resources through repeated TLS renegotiations, impacting the availability of services running on the affected server and posing a significant risk to operational stability and security.

Recommendations For CrateDB versions prior to 5.7.2, update to version 5.7.2 to resolve the issue. As a temporary workaround, consider restricting access to the TLS endpoint on port 4200 to minimize the risk of exploitation. Avoid using the TLS renegotiation feature until the issue is resolved.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2024-37309

GHSA-X268-QPG6-W9G2

Affected Products

Cratedb

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37309.json · Exploit
• https://github.com/crate/crate/security/advisories/GHSA-x268-qpg6-w9g2 · Vendor Advisory
• https://github.com/crate/crate/commit/1dde03bdf031a20886065195527e368e4a3218b3 · Patch
• https://osv.dev/vulnerability/CVE-2024-37309 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37309 · Security Note
• https://osv.dev/vulnerability/GHSA-x268-qpg6-w9g2 · Vendor Advisory
• https://github.com/crate/crate · Note
• https://cratedb.com/docs/crate/reference/en/latest/appendices/release-notes/5.7.2.html · Note