PT-2024-36558 · Colpack+1 · Colpack+1

Wolfgang Frisch · Published 2024-12-09 · Updated 2024-12-17 · CVE-2024-55566

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ColPack versions 1.0.10 through 9a7293a

Description The issue is related to the creation of predictable temporary files in ColPack, located under /tmp with names derived from an unseeded Random Number Generator (RNG). This can lead to overwriting files or making ColPack graphing unavailable to other users.

Recommendations For ColPack versions 1.0.10 through 9a7293a, consider restricting access to the /tmp directory to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using ColPack graphing functionality that relies on temporary files in /tmp until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-335

Related Identifiers

CVE-2024-55566

Affected Products

Colpack

Debian

References · 14

• https://osv.dev/vulnerability/CVE-2024-55566 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55566 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-55566 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-55566 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-55566 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-55566 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-55566 · Vendor Advisory
• https://github.com/CSCsw/ColPack/blob/9a7293a8dfd66a60434496b8df5ebb4274d70339/src/Utilities/extra.cpp#L184-L190 · Note
• https://cwe.mitre.org/data/definitions/335.html · Note
• https://bugzilla.suse.com/show_bug.cgi?id=1225617 · Note
• https://t.me/cvenotify/104622 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1865951779176730992 · Twitter Post
• https://t.me/cvedetector/12346 · Telegram Post
• https://t.me/cvenotify/103492 · Telegram Post