Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: The OpenAFS Foundation OpenAFS 1.6.24, 1.8.12.2, 1.9.1 Clear all filters
TI-2024-09627 CVE-2024-10397 · GHSA-wfh7-4g7r-cxxq

Preallocated buffer overflows in XDR responses

Priority LOW 34

A malicious server can crash the OpenAFS cache manager and other client utilities, and possibly execute arbitrary code.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00405 Published 2024-11-14 Fixed in 1.6.24, 1.8.12.2 +1 CWE-787
TI-2024-09626 CVE-2024-10396 · GHSA-mqv3-f225-3xw2

Fileserver crash and possible information leak on StoreACL/FetchACL

Priority LOW 30

An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00559 Published 2024-11-14 Fixed in 1.6.24, 1.8.12.2 +1 CWE-772
TI-2024-09624 CVE-2024-10394 · GHSA-263m-wcmp-r5j6

Theft of credentials in Unix client PAGs

Priority LOW 36

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user…

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00202 Published 2024-11-14 Fixed in 1.6.24, 1.8.12.2 +1 CWE-305