Azure IoT Platform Device SDK Remote Code Execution Vulnerability
Summary
Azure IoT Platform Device SDK Remote Code Execution Vulnerability
Original description
The description as published by the source.
The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities, a memory allocation may fail causing a use-after-free issue and if a client called it during connection communication it may cause a remote code execution. Users are advised to update the submodule with commit 30865c9c. There are no known workarounds for this vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-25110 azure-uamqp-python
- Ubuntu UBUNTU-CVE-2024-25110 azure-uamqp-python
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com