Bug 2265034 (CVE-2024-26134)

Summary:	CVE-2024-26134 cbor2: Potential buffer overflow in CBOR2 decoder
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	cbor2 5.6.2	Doc Type:	---
Doc Text:	A flaw was found in the cbor2 library. An attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2265035, 2265036
Bug Blocks:

Description Avinash Hanwate 2024-02-20 03:08:16 UTC

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.

https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542
https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df
https://github.com/agronholm/cbor2/pull/204
https://github.com/agronholm/cbor2/releases/tag/5.6.2
https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m

Comment 1 Avinash Hanwate 2024-02-20 03:11:47 UTC

Created python-cbor2 tracking bugs for this issue:

Affects: epel-all [bug 2265035]
Affects: fedora-all [bug 2265036]