Vulnerability-Lookup

CVE-2024-3205 (GCVE-0-2024-3205)

Vulnerability from cvelistv5 – Published: 2024-04-02 22:31 – Updated: 2024-05-27 15:10

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The maintainer identified an error in the libyaml fuzzers. It is not possible to reproduce nor exploit the issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2024-05-27T15:10:36.308Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The maintainer identified an error in the libyaml fuzzers. It is not possible to reproduce nor exploit the issue."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2024-3205",
    "datePublished": "2024-04-02T22:31:05.374Z",
    "dateRejected": "2024-05-27T15:10:36.308Z",
    "dateReserved": "2024-04-02T16:38:00.619Z",
    "dateUpdated": "2024-05-27T15:10:36.308Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-3205\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2024-04-02T23:15:54.627\",\"lastModified\":\"2024-05-27T15:15:08.930\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The maintainer identified an error in the libyaml fuzzers. It is not possible to reproduce nor exploit the issue.\"}],\"metrics\":{},\"references\":[]}}"
  }
}

FKIE_CVE-2024-3205

Vulnerability from fkie_nvd - Published: 2024-04-02 23:15 - Updated: 2024-05-27 15:15

Severity ?

Summary

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The maintainer identified an error in the libyaml fuzzers. It is not possible to reproduce nor exploit the issue.

References

	URL	Tags

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The maintainer identified an error in the libyaml fuzzers. It is not possible to reproduce nor exploit the issue."
    }
  ],
  "id": "CVE-2024-3205",
  "lastModified": "2024-05-27T15:15:08.930",
  "metrics": {},
  "published": "2024-04-02T23:15:54.627",
  "references": [],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Rejected"
}

GSD-2024-3205

Vulnerability from gsd - Updated: 2024-04-03 05:02

Details

A vulnerability was found in yaml libyaml up to 0.2.5 and classified as critical. Affected by this issue is the function yaml_emitter_emit_flow_sequence_item of the file /src/libyaml/src/emitter.c. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259052. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Aliases

CVE-2024-3205

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-3205"
      ],
      "details": "A vulnerability was found in yaml libyaml up to 0.2.5 and classified as critical. Affected by this issue is the function yaml_emitter_emit_flow_sequence_item of the file /src/libyaml/src/emitter.c. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259052. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
      "id": "GSD-2024-3205",
      "modified": "2024-04-03T05:02:29.888819Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cna@vuldb.com",
        "ID": "CVE-2024-3205",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "libyaml",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "0.2.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "0.2.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "0.2.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "0.2.3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "0.2.4"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "0.2.5"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "yaml"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "AlkaidLx (VulDB User)"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A vulnerability was found in yaml libyaml up to 0.2.5 and classified as critical. Affected by this issue is the function yaml_emitter_emit_flow_sequence_item of the file /src/libyaml/src/emitter.c. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259052. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
          },
          {
            "lang": "deu",
            "value": "Eine Schwachstelle wurde in yaml libyaml bis 0.2.5 gefunden. Sie wurde als kritisch eingestuft. Dies betrifft die Funktion yaml_emitter_emit_flow_sequence_item der Datei /src/libyaml/src/emitter.c. Mit der Manipulation mit unbekannten Daten kann eine heap-based buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-122",
                "lang": "eng",
                "value": "CWE-122 Heap-based Buffer Overflow"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://vuldb.com/?id.259052",
            "refsource": "MISC",
            "url": "https://vuldb.com/?id.259052"
          },
          {
            "name": "https://vuldb.com/?ctiid.259052",
            "refsource": "MISC",
            "url": "https://vuldb.com/?ctiid.259052"
          },
          {
            "name": "https://vuldb.com/?submit.304561",
            "refsource": "MISC",
            "url": "https://vuldb.com/?submit.304561"
          },
          {
            "name": "https://drive.google.com/drive/folders/1lwNEs8wqwkUV52f3uQNYMPrxRuXPtGQs?usp=sharing",
            "refsource": "MISC",
            "url": "https://drive.google.com/drive/folders/1lwNEs8wqwkUV52f3uQNYMPrxRuXPtGQs?usp=sharing"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "A vulnerability was found in yaml libyaml up to 0.2.5 and classified as critical. Affected by this issue is the function yaml_emitter_emit_flow_sequence_item of the file /src/libyaml/src/emitter.c. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259052. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad fue encontrada en yaml libyaml hasta 0.2.5 y clasificada como cr\u00edtica. La funci\u00f3n yaml_emitter_emit_flow_sequence_item del archivo /src/libyaml/src/emitter.c es afectada por esta vulnerabilidad. La manipulaci\u00f3n conduce a un desbordamiento de b\u00fafer de almacenamiento din\u00e1mico. El ataque puede lanzarse de forma remota. El exploit ha sido divulgado al p\u00fablico y puede utilizarse. El identificador de esta vulnerabilidad es VDB-259052. NOTA: Se contact\u00f3 primeramente al proveedor sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."
          }
        ],
        "id": "CVE-2024-3205",
        "lastModified": "2024-04-11T01:25:56.010",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 7.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "cna@vuldb.com",
              "type": "Secondary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.4,
              "source": "cna@vuldb.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-04-02T23:15:54.627",
        "references": [
          {
            "source": "cna@vuldb.com",
            "url": "https://drive.google.com/drive/folders/1lwNEs8wqwkUV52f3uQNYMPrxRuXPtGQs?usp=sharing"
          },
          {
            "source": "cna@vuldb.com",
            "url": "https://vuldb.com/?ctiid.259052"
          },
          {
            "source": "cna@vuldb.com",
            "url": "https://vuldb.com/?id.259052"
          },
          {
            "source": "cna@vuldb.com",
            "url": "https://vuldb.com/?submit.304561"
          }
        ],
        "sourceIdentifier": "cna@vuldb.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-122"
              }
            ],
            "source": "cna@vuldb.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

GHSA-C9H7-QC47-J43V

Vulnerability from github – Published: 2024-04-03 00:30 – Updated: 2024-04-03 00:30

Details

Severity ?

7.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-3205"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-122"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-02T23:15:54Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability was found in yaml libyaml up to 0.2.5 and classified as critical. Affected by this issue is the function yaml_emitter_emit_flow_sequence_item of the file /src/libyaml/src/emitter.c. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259052. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-c9h7-qc47-j43v",
  "modified": "2024-04-03T00:30:55Z",
  "published": "2024-04-03T00:30:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3205"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/drive/folders/1lwNEs8wqwkUV52f3uQNYMPrxRuXPtGQs?usp=sharing"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.259052"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.259052"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.304561"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-3205 (GCVE-0-2024-3205)

FKIE_CVE-2024-3205

GSD-2024-3205

GHSA-C9H7-QC47-J43V

Tags

Sightings

Nomenclature