CVE-2024-26462

Exploit

EPSS 0.44%
Veröffentlicht 29.02.2024 01:44:18
Zuletzt bearbeitet 25.03.2025 20:15:21
Erkennungen
Login

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

NVD 8 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mit ≫ Kerberos 5 Version 1.21.2

Netapp ≫ Active Iq Unified Manager Version - SwPlatform vmware_vsphere

Netapp ≫ Cloud Volumes Ontap Mediator Version -

Netapp ≫ Management Services For Element Software And Netapp Hci Version -

Netapp ≫ Ontap Select Deploy Administration Utility Version -

Netapp ≫ H610c Firmware Version -

Netapp ≫ H610c Version -

Netapp ≫ H610s Firmware Version -

Netapp ≫ H610s Version -

Netapp ≫ H615c Firmware Version -

Netapp ≫ H615c Version -

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.44%	0.347

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	5.5	1.8	3.6	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CISA-ADP	5.5	1.8	3.6	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_3.md

Exploit

https://security.netapp.com/advisory/ntap-20240415-0012/

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2024-26462

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-26462

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-26462

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2024-26462