CVE-2024-45490

CVE Details

CVE-2024-45490

Last Update

11/7/24

NIST CVE Summary

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

Our Official Summary

This CVE is a critical vulnerability affecting images using libexpat libraries versions prior to 2.6.3, where the function xmlparse.c fails to reject negative lengths in XML_ParseBuffer. This vulnerability can be exploited over a network without user interaction and has very low attack complexity. Not all of the images affected use the specific function affected. Exploiting this vulnerable library will require a user to compromise the containers and gain privileged access. Fix available in libexpat versions > 2.6.3. Investigating upgrading this library within the affected images.

CVE Severity

9.8

Status

Ongoing

Affected Products & Versions

• Palette VerteX airgap 4.4.14, 4.4.18, 4.5.3
• Palette Enterprise airgap 4.4.18, 4.5.3, 4.5.8
• Palette VerteX 4.5.3
• Palette Enterprise 4.5.3, 4.5.8

Revision History

• 1.0 08/16/2024 Initial Publication
• 2.0 08/17/2024 Added Palette VerteX airgap 4.4.14 to Affected Products
• 3.0 09/17/2024 Added Palette VerteX airgap 4.4.18 & Palette Enterprise airgap 4.4.18 to Affected Products
• 4.0 10/10/2024 Added Palette VerteX airgap 4.5.3 & Palette Enterprise airgap 4.5.3 to Affected Products
• 5.0 10/14/2024 Added Palette Enterprise & Palette VerteX 4.5.3 to Affected Products
• 6.0 11/7/2024 Added Palette Enterprise & Palette Enterprise airgap 4.5.8 to Affected Products