Vulnerability details
CVE-2024-45289
FreeBSD FreeBSD
Unbounded allocation in ctl(4) CAM Target Layer
CVSS 3.1
7.5High
Official description
The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname. The environment variable name used by fetch(1) to pass the filename to the library was incorrect, in effect ignoring the option. Fetch would still connect to a host presenting a certificate included in the revocation file passed to the --crl option.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| FreeBSD | FreeBSD | 13.3-RELEASE ≤ v < p8 | CVEProject cvelistV5 (CNA) |
| FreeBSD | FreeBSD | 13.3-release ≤ v < p8 | CISA ADP / Vulnrichment |
| FreeBSD | FreeBSD | 13.4-RELEASE ≤ v < p2 | CVEProject cvelistV5 (CNA) |
| FreeBSD | FreeBSD | 13.4-release ≤ v < p2 | CISA ADP / Vulnrichment |
| FreeBSD | FreeBSD | 14.1-RELEASE ≤ v < p6 | CVEProject cvelistV5 (CNA) |
| FreeBSD | FreeBSD | 14.1-release ≤ v < p6 | CISA ADP / Vulnrichment |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2024-11-12
- Last updated
- 2025-01-10
- State
- Published
- Assigner (CNA)
- freebsd
Exploit prediction (EPSS)
0.27%
Probability of exploitation in 30 days
20.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-665Improper Initialization