PT-2024-33511 · Tacquito · Tacquito

Published 2024-10-17 · Updated 2024-11-01 · CVE-2024-49400

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tacquito versions prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2

Description The issue concerns the improper performance of regex matches on authorized commands and arguments. Configured allowed commands/arguments were intended to require a match on the entire string, but instead only enforced a match on a sub-string. This behavior could have potentially allowed unauthorized commands to be executed. Network administrators who have deployed Tacquito in their production environments and use it to perform command authorization for network devices are impacted.

Recommendations For versions prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2, update to the latest GitHub repository commit to get the patch. As a temporary workaround, users can add boundary conditions anchors '^' and '$' to their command configurations to remediate the vulnerability without the upgrade.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2024-49400

GHSA-J42F-WC6V-5XPQ

GHSA-P5WF-CMR4-XRWR

Affected Products

Tacquito

References · 10

• https://osv.dev/vulnerability/GHSA-j42f-wc6v-5xpq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49400 · Security Note
• https://osv.dev/vulnerability/GHSA-p5wf-cmr4-xrwr · Vendor Advisory
• https://github.com/facebookincubator/tacquito/commit/07b49d1358e6ec0b5aa482fcd284f509191119e2 · Note
• https://github.com/facebookincubator/tacquito/security/advisories/GHSA-p5wf-cmr4-xrwr · Note
• https://github.com/facebookincubator/tacquito · Note
• https://twitter.com/CVEnew/status/1846967462371156433 · Twitter Post
• https://t.me/cvedetector/8204 · Telegram Post
• https://t.me/cvenotify/100353 · Telegram Post
• https://facebook.com/security/advisories/cve-2024-49400 · Note