PT-2024-34667 · Unknown · Loona-Hpack

Lowfasterthanlime · Published 2024-11-04 · Updated 2024-11-05 · CVE-2024-51502

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions loona-hpack versions prior to 0.4.3

Description The issue affects users who try to decode untrusted input using the Decoder. All users who do this are vulnerable to the exploit. The problem is similar to the one documented in the original hpack issue #11. There are no known workarounds for this vulnerability.

Recommendations For versions prior to 0.4.3, upgrade to release version 0.4.3 to address the issue. As a temporary workaround, consider avoiding the use of the Decoder with untrusted input until the upgrade is applied.

Exploit

Fix

Improper Handling of Exceptional Conditions

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-754

Related Identifiers

CVE-2024-51502

GHSA-7VM6-QWH5-9X44

Affected Products

Loona-Hpack

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51502.json · Exploit
• https://osv.dev/vulnerability/GHSA-7vm6-qwh5-9x44 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51502 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51502 · Vendor Advisory
• https://github.com/bearcove/loona/security/advisories/GHSA-7vm6-qwh5-9x44 · Note
• https://github.com/bearcove/loona · Note
• https://github.com/bearcove/loona/commit/9a4028ec6484f50a320281271a41a5040ddb1ba8 · Note
• https://github.com/mlalic/hpack-rs/issues/11 · Note
• https://twitter.com/VulmonFeeds/status/1853694563002487150 · Twitter Post
• https://twitter.com/CVEnew/status/1853570767604089296 · Twitter Post
• https://github.com/advisories/GHSA-w7hm-hmxv-pvhf · Note
• https://t.me/cvedetector/9793 · Telegram Post