CVE-2024-31209

{"id": "CVE-2024-31209", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 0.8}]}, "published": "2024-04-04T16:15:09.550", "references": [{"url": "https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388", "source": "[email protected]"}, {"url": "https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c", "source": "[email protected]"}, {"url": "https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649", "source": "[email protected]"}, {"url": "https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a", "source": "[email protected]"}, {"url": "https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p", "source": "[email protected]"}, {"url": "https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` & `3.2.0-beta.3`."}, {"lang": "es", "value": "oidcc es la librer\u00eda cliente OpenID Connect para Erlang. La denegaci\u00f3n de servicio (DoS) por agotamiento de Atom es posible llamando a `oidcc_provider_configuration_worker:get_provider_configuration/1` o `oidcc_provider_configuration_worker:get_jwks/1`. Este problema se ha solucionado en las versiones `3.1.2` y `3.2.0-beta.3`."}], "lastModified": "2024-11-21T09:13:02.683", "sourceIdentifier": "[email protected]"}