CVE-2024-4854 - Vulnerability Details - OpenCVE

MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://gitlab.com/wireshark/wireshark/-/issues/19726
https://gitlab.com/wireshark/wireshark/-/merge_requests/15047
https://gitlab.com/wireshark/wireshark/-/merge_requests/15499
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/66H2BSENPSIALF2WIZF7M3QBVWYBMFGW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MKFJAZDKXGFFQPRDYLX2AANRNMYZZEZ/
https://nvd.nist.gov/vuln/detail/CVE-2024-4854
https://www.cve.org/CVERecord?id=CVE-2024-4854
https://www.wireshark.org/security/wnpa-sec-2024-07.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitLab

Published: 2024-05-14T00:03:12.486Z

Updated: 2024-08-29T15:04:58.774Z

Reserved: 2024-05-14T00:02:57.493Z

Link: CVE-2024-4854

Vulnrichment

Updated: 2024-08-01T20:55:10.081Z

NVD

Status : Awaiting Analysis

Published: 2024-05-14T15:45:18.890

Modified: 2024-11-21T09:43:44.263

Link: CVE-2024-4854

Redhat

Severity : Moderate

Publid Date: 2024-05-15T00:00:00Z

Links: CVE-2024-4854 - Bugzilla

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-4854", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2024-05-14T00:02:57.493Z", "datePublished": "2024-05-14T00:03:12.486Z", "dateUpdated": "2024-08-29T15:04:58.774Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Wireshark", "vendor": "Wireshark Foundation", "versions": [{"lessThan": "4.2.5", "status": "affected", "version": "4.2.0", "versionType": "semver"}, {"lessThan": "4.0.15", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.23", "status": "affected", "version": "3.6.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-835", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2024-08-29T15:04:58.774Z"}, "references": [{"url": "https://www.wireshark.org/security/wnpa-sec-2024-07.html"}, {"name": "GitLab Issue #19726", "tags": ["issue-tracking", "permissions-required"], "url": "https://gitlab.com/wireshark/wireshark/-/issues/19726"}, {"url": "https://gitlab.com/wireshark/wireshark/-/merge_requests/15047"}, {"url": "https://gitlab.com/wireshark/wireshark/-/merge_requests/15499"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 4.2.5 or above."}], "title": "Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-12T14:25:52.767657Z", "id": "CVE-2024-4854", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-12T14:25:59.472Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:55:10.081Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.wireshark.org/security/wnpa-sec-2024-07.html", "tags": ["x_transferred"]}, {"url": "https://gitlab.com/wireshark/wireshark/-/issues/19726", "name": "GitLab Issue #19726", "tags": ["issue-tracking", "permissions-required", "x_transferred"]}, {"url": "https://gitlab.com/wireshark/wireshark/-/merge_requests/15047", "tags": ["x_transferred"]}, {"url": "https://gitlab.com/wireshark/wireshark/-/merge_requests/15499", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/66H2BSENPSIALF2WIZF7M3QBVWYBMFGW/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MKFJAZDKXGFFQPRDYLX2AANRNMYZZEZ/", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.wireshark.org/security/wnpa-sec-2024-07.html", "tags": ["x_transferred"]}, {"url": "https://gitlab.com/wireshark/wireshark/-/issues/19726", "name": "GitLab Issue #19726", "tags": ["issue-tracking", "permissions-required", "x_transferred"]}, {"url": "https://gitlab.com/wireshark/wireshark/-/merge_requests/15047", "tags": ["x_transferred"]}, {"url": "https://gitlab.com/wireshark/wireshark/-/merge_requests/15499", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/66H2BSENPSIALF2WIZF7M3QBVWYBMFGW/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MKFJAZDKXGFFQPRDYLX2AANRNMYZZEZ/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:55:10.081Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4854", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-12T14:25:52.767657Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-12T14:25:56.741Z"}}], "cna": {"title": "Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Wireshark Foundation", "product": "Wireshark", "versions": [{"status": "affected", "version": "4.2.0", "lessThan": "4.2.5", "versionType": "semver"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.15", "versionType": "semver"}, {"status": "affected", "version": "3.6.0", "lessThan": "3.6.23", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 4.2.5 or above."}], "references": [{"url": "https://www.wireshark.org/security/wnpa-sec-2024-07.html"}, {"url": "https://gitlab.com/wireshark/wireshark/-/issues/19726", "name": "GitLab Issue #19726", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://gitlab.com/wireshark/wireshark/-/merge_requests/15047"}, {"url": "https://gitlab.com/wireshark/wireshark/-/merge_requests/15499"}], "descriptions": [{"lang": "en", "value": "MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2024-08-29T15:04:58.774Z"}}}, "cveMetadata": {"cveId": "CVE-2024-4854", "state": "PUBLISHED", "dateUpdated": "2024-08-29T15:04:58.774Z", "dateReserved": "2024-05-14T00:02:57.493Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2024-05-14T00:03:12.486Z", "assignerShortName": "GitLab"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file"}, {"lang": "es", "value": "Los bucles infinitos de disecci\u00f3n TLV de MONGO y ZigBee en Wireshark 4.2.0 a 4.2.4, 4.0.0 a 4.0.14 y 3.6.0 a 3.6.22 permiten la denegaci\u00f3n de servicio mediante inyecci\u00f3n de paquetes o archivo de captura manipulado"}], "id": "CVE-2024-4854", "lastModified": "2024-11-21T09:43:44.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.7, "source": "cve@gitlab.com", "type": "Secondary"}]}, "published": "2024-05-14T15:45:18.890", "references": [{"source": "cve@gitlab.com", "url": "https://gitlab.com/wireshark/wireshark/-/issues/19726"}, {"source": "cve@gitlab.com", "url": "https://gitlab.com/wireshark/wireshark/-/merge_requests/15047"}, {"source": "cve@gitlab.com", "url": "https://gitlab.com/wireshark/wireshark/-/merge_requests/15499"}, {"source": "cve@gitlab.com", "url": "https://www.wireshark.org/security/wnpa-sec-2024-07.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://gitlab.com/wireshark/wireshark/-/issues/19726"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://gitlab.com/wireshark/wireshark/-/merge_requests/15047"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://gitlab.com/wireshark/wireshark/-/merge_requests/15499"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/66H2BSENPSIALF2WIZF7M3QBVWYBMFGW/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MKFJAZDKXGFFQPRDYLX2AANRNMYZZEZ/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.wireshark.org/security/wnpa-sec-2024-07.html"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "cve@gitlab.com", "type": "Secondary"}]}