AZL-43320

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-43320.json

JSON Data

https://api.test.osv.dev/v1/vulns/AZL-43320

Upstream

CVE-2024-38517

Published

2024-07-09T19:15:12Z

Modified

2026-04-01T05:15:04.375558Z

Summary

CVE-2024-38517 affecting package ceph for versions less than 16.2.10-5

Details

Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the GenericReader::ParseNumber() function of include/rapidjson/reader.h when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-38517

Affected packages

Azure Linux:2 / ceph

Package

Name: ceph
Purl: pkg:rpm/azure-linux/ceph

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

16.2.10-5

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-43320.json"