CVE-2024-36404
3 advisories.
Maven/org.geotools:gt-app-schema CVE-2024-36404: critical 9.8
GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions
Action: Upgrade org.geotools:gt-app-schema to 28.6 (28.x), 29.6 (29.x), 30.4 (30.x) or 31.2 (31.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 30.0 | 30.4 | - |
| 31.0 | 31.2 | - |
| 29.0 | 29.6 | - |
| 0 | 28.6 | - |
Fixed versions
| 30.4 | 31.2 | 29.6 | 28.6 |
Sources
- osv: GHSA-w3pj-wh35-fq8w
- https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w
- https://nvd.nist.gov/vuln/detail/CVE-2024-36404
- https://github.com/geotools/geotools/pull/4797
- https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea
- https://sourceforge.net/projects/geotools/files/GeoTools%2031%20Releases/31.1
- https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.3/geotools-30.3-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.2/geotools-30.2-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2029%20Releases/29.2/geotools-29.2-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2028%20Releases/28.2/geotools-28.2-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.5/geotools-27.5-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.4/geotools-27.4-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.7/geotools-26.7-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.4
- https://sourceforge.net/projects/geotools/files/GeoTools%2025%20Releases/25.2/geotools-25.2-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2024%20Releases/24.0/geotools-24.0-patches.zip/download
- https://osgeo-org.atlassian.net/browse/GEOT-7587
- https://github.com/geotools/geotools
- https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
CVE-2024-36404 · published · modified · JSON
Maven/org.geotools:gt-complex CVE-2024-36404: critical 9.8
GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions
Action: Upgrade org.geotools:gt-complex to 28.6 (28.x), 29.6 (29.x), 30.4 (30.x) or 31.2 (31.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 30.0 | 30.4 | - |
| 31.0 | 31.2 | - |
| 29.0 | 29.6 | - |
| 0 | 28.6 | - |
Fixed versions
| 30.4 | 31.2 | 29.6 | 28.6 |
Sources
- osv: GHSA-w3pj-wh35-fq8w#Maven/org.geotools:gt-complex
- https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w
- https://nvd.nist.gov/vuln/detail/CVE-2024-36404
- https://github.com/geotools/geotools/pull/4797
- https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea
- https://sourceforge.net/projects/geotools/files/GeoTools%2031%20Releases/31.1
- https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.3/geotools-30.3-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.2/geotools-30.2-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2029%20Releases/29.2/geotools-29.2-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2028%20Releases/28.2/geotools-28.2-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.5/geotools-27.5-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.4/geotools-27.4-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.7/geotools-26.7-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.4
- https://sourceforge.net/projects/geotools/files/GeoTools%2025%20Releases/25.2/geotools-25.2-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2024%20Releases/24.0/geotools-24.0-patches.zip/download
- https://osgeo-org.atlassian.net/browse/GEOT-7587
- https://github.com/geotools/geotools
- https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
CVE-2024-36404 · published · modified · JSON
Maven/org.geotools.xsd:gt-xsd-core CVE-2024-36404: critical 9.8
GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions
Action: Upgrade org.geotools.xsd:gt-xsd-core to 28.6 (28.x), 29.6 (29.x), 30.4 (30.x) or 31.2 (31.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 30.0 | 30.4 | - |
| 31.0 | 31.2 | - |
| 29.0 | 29.6 | - |
| 0 | 28.6 | - |
Fixed versions
| 30.4 | 31.2 | 29.6 | 28.6 |
Sources
- osv: GHSA-w3pj-wh35-fq8w#Maven/org.geotools.xsd:gt-xsd-core
- https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w
- https://nvd.nist.gov/vuln/detail/CVE-2024-36404
- https://github.com/geotools/geotools/pull/4797
- https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea
- https://sourceforge.net/projects/geotools/files/GeoTools%2031%20Releases/31.1
- https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.3/geotools-30.3-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.2/geotools-30.2-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2029%20Releases/29.2/geotools-29.2-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2028%20Releases/28.2/geotools-28.2-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.5/geotools-27.5-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.4/geotools-27.4-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.7/geotools-26.7-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.4
- https://sourceforge.net/projects/geotools/files/GeoTools%2025%20Releases/25.2/geotools-25.2-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2024%20Releases/24.0/geotools-24.0-patches.zip/download
- https://osgeo-org.atlassian.net/browse/GEOT-7587
- https://github.com/geotools/geotools
- https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
CVE-2024-36404 · published · modified · JSON