Read the docs
TI-2024-10134 Aliases CVE-2024-10933GHSA-6pwm-f65f-3g86

OpenBSD readdir directory traversal

Priority LOW 19CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any '/' in readdir name validation to avoid unexpected directory traversal on untrusted file systems.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0027 19th percentileScored 2026-11-07
Fix Fixed OpenBSD (OpenBSD): 7.5 errata 009, 7.4 errata 022

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenBSDOpenBSD7.5 to before 7.5 errata 009; 7.4 to before 7.4 errata 0227.5 errata 009, 7.4 errata 022Patch availableCNA
  • OpenBSD VendorOpenBSD Affected 7.5 to before 7.5 errata 009; 7.4 to before 7.4 errata 022 Fixed in 7.5 errata 009, 7.4 errata 022 Patch available CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*before 7.4VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:-:*:*:*:*:*:*7.4VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_001:*:*:*:*:*:*7.4 errata_001VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_002:*:*:*:*:*:*7.4 errata_002VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_003:*:*:*:*:*:*7.4 errata_003VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_004:*:*:*:*:*:*7.4 errata_004VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_005:*:*:*:*:*:*7.4 errata_005VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_006:*:*:*:*:*:*7.4 errata_006VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_007:*:*:*:*:*:*7.4 errata_007VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_008:*:*:*:*:*:*7.4 errata_008VulnerableOpenBSD
  • cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:* Versions before 7.4 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:-:*:*:*:*:*:* Versions 7.4 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_001:*:*:*:*:*:* Versions 7.4 errata_001 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_002:*:*:*:*:*:* Versions 7.4 errata_002 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_003:*:*:*:*:*:* Versions 7.4 errata_003 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_004:*:*:*:*:*:* Versions 7.4 errata_004 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_005:*:*:*:*:*:* Versions 7.4 errata_005 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_006:*:*:*:*:*:* Versions 7.4 errata_006 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_007:*:*:*:*:*:* Versions 7.4 errata_007 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_008:*:*:*:*:*:* Versions 7.4 errata_008 Vulnerable ·OpenBSD
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:openbsd:openbsd:7.4:errata_009:*:*:*:*:*:*7.4 errata_009VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_010:*:*:*:*:*:*7.4 errata_010VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_011:*:*:*:*:*:*7.4 errata_011VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_012:*:*:*:*:*:*7.4 errata_012VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_013:*:*:*:*:*:*7.4 errata_013VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_014:*:*:*:*:*:*7.4 errata_014VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_015:*:*:*:*:*:*7.4 errata_015VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_016:*:*:*:*:*:*7.4 errata_016VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_017:*:*:*:*:*:*7.4 errata_017VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_018:*:*:*:*:*:*7.4 errata_018VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_019:*:*:*:*:*:*7.4 errata_019VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_020:*:*:*:*:*:*7.4 errata_020VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_021:*:*:*:*:*:*7.4 errata_021VulnerableOpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_009:*:*:*:*:*:* Versions 7.4 errata_009 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_010:*:*:*:*:*:* Versions 7.4 errata_010 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_011:*:*:*:*:*:* Versions 7.4 errata_011 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_012:*:*:*:*:*:* Versions 7.4 errata_012 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_013:*:*:*:*:*:* Versions 7.4 errata_013 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_014:*:*:*:*:*:* Versions 7.4 errata_014 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_015:*:*:*:*:*:* Versions 7.4 errata_015 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_016:*:*:*:*:*:* Versions 7.4 errata_016 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_017:*:*:*:*:*:* Versions 7.4 errata_017 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_018:*:*:*:*:*:* Versions 7.4 errata_018 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_019:*:*:*:*:*:* Versions 7.4 errata_019 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_020:*:*:*:*:*:* Versions 7.4 errata_020 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_021:*:*:*:*:*:* Versions 7.4 errata_021 Vulnerable ·OpenBSD

Remediation

  • Fix · CNA OpenBSD (OpenBSD) Fixed in 7.5 errata 009, 7.4 errata 022

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10933
  2. 2026-10-03 Alias added: GHSA-6pwm-f65f-3g86

References

Patch 2

  • TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
  • TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
  • TI-2007-05153 Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD… CVSS 2.0HIGH 7.2
  • TI-2001-00539 Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows… CVSS 2.0HIGH 10.0
  • TI-2026-40218 sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication… CVSS 3.1HIGH 8.3
  • TI-2004-00444 Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31… CVSS 2.0HIGH 10.0
See all 200 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences