azure-uamqp-python: CVE-2024-27099

Debian Bug report logs - #1064996
azure-uamqp-python: CVE-2024-27099

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: azure-uamqp-python: CVE-2024-27099

Date: Wed, 28 Feb 2024 20:54:09 +0100

Source: azure-uamqp-python
Version: 1.6.8-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for azure-uamqp-python.

CVE-2024-27099[0]:
| The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud
| Services. When processing an incorrect `AMQP_VALUE` failed state,
| may cause a double free problem. This may cause a RCE. Update
| submodule with commit 2ca42b6e4e098af2d17e487814a91d05f6ae4987.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-27099
    https://www.cve.org/CVERecord?id=CVE-2024-27099
[1] https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-6rh4-fj44-v4jj

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Send a report that this bug log contains spam.