PT-2024-28052 · Unknown · Nlohmann/Json+1

Bm1549 · CVE-2024-38525 · Published 2024-06-28 · Updated 2024-07-01

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions dd-trace-cpp versions prior to 0.2.2

Description The issue occurs when the library fails to extract trace context due to malformed unicode. It attempts to log the list of audited headers and their values using the nlohmann JSON library. However, the invocation of the JSON library results in an uncaught exception, leading to a crash.

Recommendations For versions prior to 0.2.2, update to version 0.2.2 to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-248

CWE-20

Related Identifiers

CVE-2024-38525

GHSA-RF3P-MG22-QV6W

Affected Products

Dd-Trace-Cpp

Nlohmann/Json

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38525.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-38525 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38525 · Vendor Advisory
• https://github.com/DataDog/dd-trace-cpp/security/advisories/GHSA-rf3p-mg22-qv6w · Note
• https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.2.2 · Note
• https://t.me/cvenotify/84832 · Telegram Post