PT-2024-32493 · Apache · Apache Nimble

Wei Che Kao + 1 · Published 2024-11-26 · Updated 2025-07-08 · CVE-2024-47248

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Apache NimBLE versions through 1.7.0

Description A Buffer Copy without Checking Size of Input, also known as a 'Classic Buffer Overflow', vulnerability in Apache NimBLE could result in memory corruption when a specially crafted MESH message is used and a non-default build configuration is applied. Users are recommended to upgrade to a newer version to fix the issue.

Recommendations For Apache NimBLE versions through 1.7.0, upgrade to version 1.8.0, which fixes the issue. As a temporary workaround, consider restricting the use of specially crafted MESH messages to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2024-47248

Affected Products

Apache Nimble

References · 10

• https://github.com/apache/mynewt-nimble/commit/4f75c0b3b466186beff40e8489870c6cee076aaa · Patch
• https://lists.apache.org/thread/z8m7jqh54xybf9kz8q2l3tz92zsj7tmz · Vendor Advisory
• http://openwall.com/lists/oss-security/2024/11/26/2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47248 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47248 · Vendor Advisory
• https://twitter.com/oss_security/status/1861511874405171206 · Twitter Post
• https://t.me/cvenotify/103290 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1861774178279469437 · Twitter Post
• https://t.me/cvenotify/127971 · Telegram Post
• https://twitter.com/CVEnew/status/1861371121355890812 · Twitter Post