PT-2024-29341 · Cortex · Cortex

Yuexi Zhang · Published 2024-08-01 · Updated 2026-01-06 · CVE-2024-41265

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions cortex version 0.42.1

Description A TLS certificate verification issue allows attackers to obtain sensitive information via the makeOperatorRequest function. This is due to cortex establishing TLS connections with the InsecureSkipVerify variable set to true.

Recommendations For cortex version 0.42.1, consider disabling the makeOperatorRequest function until a patch is available, and restrict the use of InsecureSkipVerify to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-599

Related Identifiers

CVE-2024-41265

GHSA-VW7G-3CC7-7RMH

GO-2024-3036

SUSE-SU-2026:0037-1

Affected Products

Cortex

References · 88

• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41265 · Security Note
• https://osv.dev/vulnerability/GHSA-vw7g-3cc7-7rmh · Vendor Advisory
• https://github.com/cortexproject/cortex · Note
• https://suse.com/security/cve/CVE-2025-68941 · Note
• https://suse.com/security/cve/CVE-2025-67508 · Note
• https://suse.com/security/cve/CVE-2025-10543 · Note
• https://suse.com/security/cve/CVE-2025-60633 · Note
• https://suse.com/security/cve/CVE-2025-68939 · Note
• https://suse.com/security/cve/CVE-2025-65637 · Note
• https://suse.com/security/cve/CVE-2025-66508 · Note
• https://suse.com/security/cve/CVE-2025-64702 · Note
• https://suse.com/security/cve/CVE-2025-64708 · Note
• https://suse.com/security/cve/CVE-2025-67499 · Note