PT-2024-37521 · Conduit · Conduit

Published 2024-06-25 · Updated 2024-09-20 · CVE-2024-6299

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Conduit (affected versions not specified)

Description: The issue is related to the lack of consideration of key expiry when validating signatures in Conduit. This allows an attacker who has compromised an expired key to forge requests as the remote server, as well as PDUs with timestamps past the expiry date.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-324

Related Identifiers

CVE-2024-6299

Affected Products

Conduit

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6299.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-6299 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6299 · Vendor Advisory
• https://gitlab.com/famedly/conduit/-/releases/v0.8.0 · Note
• https://t.me/cvenotify/95522 · Telegram Post
• https://t.me/cvenotify/84353 · Telegram Post
• https://t.me/cvenotify/84376 · Telegram Post
• https://conduit.rs/changelog/#v0-8-0-2024-06-12 · Note