Is CVE-2024-26134 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-26134 being exploited in the wild.

How severe is CVE-2024-26134?

Low severity, with a CVSS score of 3.1, published 19 February 2024.

Which products and versions are affected?

cbor2 (PyPI) ECOSYSTEM:introduced=5.5.1,fixed=5.6.2, GIT:introduced=0,fixed=387755eacf0be35591a478d3c67fe10618a6d542,fixed=4de6991ba29bf2290d7b9d83525eda7d021873df|ECOSYSTEM:introduced=5.5.1,fixed=5.6.2.

Is there a fix for CVE-2024-26134?

Yes. cbor2 (PyPI): upgrade to 5.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-26134 attacked?

It is attacked over the network.

Am I affected by CVE-2024-26134?

Check whether you run cbor2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-26134: CBOR2 buffer overflow in decoder

CVE-2024-26134 · Severity: low · CVSS 3.1 · Published 2024-02-19

CBOR2 is a Python library for encoding and decoding CBOR (Concise Binary Object Representation) data, widely used for efficient serialization in IoT and other applications. An attacker who can send a maliciously crafted CBOR message with an oversized string payload can crash services that use this library, causing a denial of service.

Technologies: cbor2 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-26134 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-26134 being exploited in the wild.
How severe is CVE-2024-26134?: Low severity, with a CVSS score of 3.1, published 19 February 2024.
Which products and versions are affected?: cbor2 (PyPI) ECOSYSTEM:introduced=5.5.1,fixed=5.6.2, GIT:introduced=0,fixed=387755eacf0be35591a478d3c67fe10618a6d542,fixed=4de6991ba29bf2290d7b9d83525eda7d021873df|ECOSYSTEM:introduced=5.5.1,fixed=5.6.2.
Is there a fix for CVE-2024-26134?: Yes. cbor2 (PyPI): upgrade to 5.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-26134 attacked?: It is attacked over the network.
Am I affected by CVE-2024-26134?: Check whether you run cbor2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

cbor2 (PyPI): upgrade to 5.6.2 or later
```
pip install "cbor2>=5.6.2"
```

Technical details

A buffer overflow vulnerability exists in the CBOR2 decoder introduced in version 5.5.1 following PR #204. The vulnerability occurs when decoding CBOR-encoded strings longer than 131,128 characters, causing the decoder to write beyond allocated buffer boundaries. The vulnerability is triggered by calling cbor2.loads() on a maliciously crafted CBOR binary; the crash manifests as "malloc(): unsorted double linked list corrupted" on resource-constrained systems and SystemError on others. The attack requires network reachability to a service parsing untrusted CBOR data and no authentication. The fix is available in version 5.6.2.

Affected products

agronholm CBOR2 5.5.1, 5.6.0, 5.6.1

Identifiers

CVE-2024-26134
GHSA-375g-39jq-vq7m
PYSEC-2024-155

Timeline

2024-02-19: disclosed: CVE-2024-26134 published
2024-02-21: advisory: GHSA-375g-39jq-vq7m published
2024-02-21: patched: Version 5.6.2 released with fix

References

https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.