Skip to content
OpenAdvisories
Medium ALAS2023-2024-684 1 CVE

Moderate: rapidjson security update (Amazon Linux 2023)

Published Aug 1, 2024 · Updated Aug 6, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-38517: Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2023 rapidjson-devel 0:1.1.0-16.amzn2023.0.3
Amazon Linux · 2023 rapidjson-doc 0:1.1.0-16.amzn2023.0.3

Vulnerabilities 1

  • Medium 6.8
    CVE-2024-38517

    Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Underflow

    Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which …

    Tencent RapidJSON ceph opencc Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-38517.html