PT-2024-31541 · Fetch+1 · Fetch+1

Franco Fichtner · Published 2024-10-29 · Updated 2025-01-10 · CVE-2024-45289

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions fetch versions (affected versions not specified)

Description The issue arises from the fetch(3) library's use of environment variables to pass information, including the revocation file pathname. However, the environment variable name used by fetch(1) to pass the filename to the library is incorrect, effectively ignoring the option. As a result, fetch would still connect to a host presenting a certificate included in the revocation file passed to the --crl option.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

CVE-2024-45289

FREEBSD-SA-24_19

Affected Products

Freebsd

Fetch

References · 7

• https://security.freebsd.org/advisories/FreeBSD-SA-24:18.ctl.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45289 · Security Note
• https://security.netapp.com/advisory/ntap-20250110-0001 · Note
• https://freebsd.org/security/advisories/FreeBSD-SA-24:19.fetch.asc · Note
• https://twitter.com/CVEnew/status/1856355639443767480 · Twitter Post
• https://t.me/cvedetector/10620 · Telegram Post
• https://t.me/cvenotify/107022 · Telegram Post