CVE-2024-42934 — Missing Authorization in Openipmi
Severity
5.0MEDIUMNVD
EPSS
0.0%
top 95.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 9
Description
OpenIPMI before 2.0.36 has an out-of-bounds array access (for authentication type) in the ipmi_sim simulator, resulting in denial of service or (with very low probability) authentication bypass or code execution.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 1.6 | Impact: 3.4
Affected Packages9 packages
🔴Vulnerability Details
2📋Vendor Advisories
3Microsoft▶
OpenIPMI before 2.0.36 has an out-of-bounds array access (for authentication type) in the ipmi_sim simulator resulting in denial of service or (with very low probability) authentication bypass or code↗2024-10-08
Red Hat▶
openipmi: missing check on the authorization type on incoming LAN messages in IPMI simulator↗2024-08-22
Debian▶
CVE-2024-42934: openipmi - OpenIPMI before 2.0.36 has an out-of-bounds array access (for authentication typ...↗2024