PT-2024-32984 · Real Time Logic · Sharkssl

Published 2024-11-12 · Updated 2025-09-15 · CVE-2024-48075

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Real Time Logic SharkSSL versions 09.09.24 and earlier

Description A Heap buffer overflow in the server-site handshake implementation allows a remote attacker to trigger a Denial-of-Service via a malformed TLS Client Key Exchange message.

Recommendations For versions 09.09.24 and earlier, as a temporary workaround, consider restricting access to the TLS Client Key Exchange message handling functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Heap Based Buffer Overflow

Buffer Overflow

Weakness Enumeration

CWE-122

CWE-120

Related Identifiers

CVE-2024-48075

Affected Products

Sharkssl

References · 8

• https://osv.dev/vulnerability/CVE-2024-48075 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48075 · Security Note
• https://github.com/RealTimeLogic/SharkSSL/commit/7045f6f254060640ff77eef2027f108fcc20e2f2 · Note
• https://t.me/cveNotify/135537 · Telegram Post
• https://telekom.com/resource/blob/1083076/8bf5c03520005b8e699dfb9bce470fc7/dl-241104-cve-2024-48075-data.pdf · Note
• https://twitter.com/CVEnew/status/1856828076388487477 · Twitter Post
• https://t.me/cvedetector/10751 · Telegram Post
• https://t.me/cvenotify/101447 · Telegram Post