CVE-2024-25110: azure-uamqp-c, инжекция

Описание

Оригинално описание

The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities, a memory allocation may fail causing a use-after-free issue and if a client called it during connection communication it may cause a remote code execution. Users are advised to update the submodule with commit `30865c9c`. There are no known workarounds for this vulnerability.

Засегнати продукти

• Azure azure-uamqp-c: < 2024-01-01

Вид слабост

• CWE-94 Неправилен контрол при генериране на код

История

Други уязвимости в Azure azure-uamqp-c

• 9.8CVE-2024-27099
• 9.8CVE-2024-21646

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2024-25110
• https://nvd.nist.gov/vuln/detail/CVE-2024-25110
• https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-c646-4whf-r67v
• https://github.com/Azure/azure-uamqp-c/commit/30865c9ccedaa32ddb036e87a8ebb52c3f18f695