PyPI/cbor2 CVE-2024-26134: high 7.5, EPSS 1.18%
Potential buffer overflow in CBOR2 decoder
Action: Upgrade cbor2 to 5.6.2 or later.
pip install cbor2==5.6.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.5.1 | 5.6.2 | - |
Fixed versions
| 5.6.2 |
Sources
- osv: GHSA-375g-39jq-vq7m
- https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m
- https://nvd.nist.gov/vuln/detail/CVE-2024-26134
- https://github.com/agronholm/cbor2/pull/204
- https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542
- https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df
- https://github.com/agronholm/cbor2
- https://github.com/agronholm/cbor2/releases/tag/5.6.2
- https://github.com/pypa/advisory-database/tree/main/vulns/cbor2/PYSEC-2024-155.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY
CVE-2024-26134 · published · modified · JSON