{ "document": { "aggregate_severity": { "text": "Medium" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos8.4els/vex/2024/cve-2024-24783-els_os-centos8_4els.json" } ], "tracking": { "current_release_date": "2026-04-10T19:37:01Z", "generator": { "date": "2026-04-10T19:37:06Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2024-24783-ELS_OS-CENTOS8.4ELS", "initial_release_date": "2024-03-05T00:00:00Z", "revision_history": [ { "date": "2024-03-05T00:00:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-04-08T20:33:38Z", "number": "2", "summary": "Official Publication" }, { "date": "2026-04-10T19:37:01Z", "number": "3", "summary": "Update document" } ], "status": "final", "version": "3" }, "title": "Security update on CVE-2024-24783" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "pam-0:1.3.1-14.el8.i686", "product": { "name": "pam-0:1.3.1-14.el8.i686", "product_id": "pam-0:1.3.1-14.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/pam@1.3.1-14.el8?arch=i686" } } }, { "category": "product_version", "name": "pam-devel-0:1.3.1-14.el8.i686", "product": { "name": "pam-devel-0:1.3.1-14.el8.i686", "product_id": "pam-devel-0:1.3.1-14.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/pam-devel@1.3.1-14.el8?arch=i686" } } }, { "category": "product_version", "name": "file-devel-0:5.33-20.el8.i686", "product": { "name": "file-devel-0:5.33-20.el8.i686", "product_id": "file-devel-0:5.33-20.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/file-devel@5.33-20.el8?arch=i686" } } }, { "category": "product_version", "name": "file-libs-0:5.33-20.el8.i686", "product": { "name": "file-libs-0:5.33-20.el8.i686", "product_id": "file-libs-0:5.33-20.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/file-libs@5.33-20.el8?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "pam-0:1.3.1-14.el8.x86_64", "product": { "name": "pam-0:1.3.1-14.el8.x86_64", "product_id": "pam-0:1.3.1-14.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/pam@1.3.1-14.el8?arch=x86_64" } } }, { "category": "product_version", "name": "pam-devel-0:1.3.1-14.el8.x86_64", "product": { "name": "pam-devel-0:1.3.1-14.el8.x86_64", "product_id": "pam-devel-0:1.3.1-14.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/pam-devel@1.3.1-14.el8?arch=x86_64" } } }, { "category": "product_version", "name": "tar-2:1.30-5.el8.x86_64", "product": { "name": "tar-2:1.30-5.el8.x86_64", "product_id": "tar-2:1.30-5.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/tar@1.30-5.el8?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "file-0:5.33-20.el8.x86_64", "product": { "name": "file-0:5.33-20.el8.x86_64", "product_id": "file-0:5.33-20.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/file@5.33-20.el8?arch=x86_64" } } }, { "category": "product_version", "name": "file-devel-0:5.33-20.el8.x86_64", "product": { "name": "file-devel-0:5.33-20.el8.x86_64", "product_id": "file-devel-0:5.33-20.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/file-devel@5.33-20.el8?arch=x86_64" } } }, { "category": "product_version", "name": "file-libs-0:5.33-20.el8.x86_64", "product": { "name": "file-libs-0:5.33-20.el8.x86_64", "product_id": "file-libs-0:5.33-20.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/file-libs@5.33-20.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "python3-magic-0:5.33-20.el8.noarch", "product": { "name": "python3-magic-0:5.33-20.el8.noarch", "product_id": "python3-magic-0:5.33-20.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/centos/python3-magic@5.33-20.el8?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 8.4", "product": { "name": "Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:8.4:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "pam-0:1.3.1-14.el8.tuxcare.els2.i686", "product": { "name": "pam-0:1.3.1-14.el8.tuxcare.els2.i686", "product_id": "pam-0:1.3.1-14.el8.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/pam@1.3.1-14.el8.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "pam-0:1.3.1-14.el8.tuxcare.els1.i686", "product": { "name": "pam-0:1.3.1-14.el8.tuxcare.els1.i686", "product_id": "pam-0:1.3.1-14.el8.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/pam@1.3.1-14.el8.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686", "product": { "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686", "product_id": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/pam-devel@1.3.1-14.el8.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686", "product": { "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686", "product_id": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/pam-devel@1.3.1-14.el8.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "file-devel-0:5.33-20.el8.tuxcare.els1.i686", "product": { "name": "file-devel-0:5.33-20.el8.tuxcare.els1.i686", "product_id": "file-devel-0:5.33-20.el8.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/file-devel@5.33-20.el8.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "file-libs-0:5.33-20.el8.tuxcare.els1.i686", "product": { "name": "file-libs-0:5.33-20.el8.tuxcare.els1.i686", "product_id": "file-libs-0:5.33-20.el8.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/file-libs@5.33-20.el8.tuxcare.els1?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "pam-0:1.3.1-14.el8.tuxcare.els2.x86_64", "product": { "name": "pam-0:1.3.1-14.el8.tuxcare.els2.x86_64", "product_id": "pam-0:1.3.1-14.el8.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/pam@1.3.1-14.el8.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "pam-0:1.3.1-14.el8.tuxcare.els1.x86_64", "product": { "name": "pam-0:1.3.1-14.el8.tuxcare.els1.x86_64", "product_id": "pam-0:1.3.1-14.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/pam@1.3.1-14.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64", "product": { "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64", "product_id": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/pam-devel@1.3.1-14.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64", "product": { "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64", "product_id": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/pam-devel@1.3.1-14.el8.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "tar-2:1.30-5.el8.tuxcare.els2.x86_64", "product": { "name": "tar-2:1.30-5.el8.tuxcare.els2.x86_64", "product_id": "tar-2:1.30-5.el8.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/tar@1.30-5.el8.tuxcare.els2?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "tar-2:1.30-5.el8.tuxcare.els1.x86_64", "product": { "name": "tar-2:1.30-5.el8.tuxcare.els1.x86_64", "product_id": "tar-2:1.30-5.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/tar@1.30-5.el8.tuxcare.els1?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "file-0:5.33-20.el8.tuxcare.els1.x86_64", "product": { "name": "file-0:5.33-20.el8.tuxcare.els1.x86_64", "product_id": "file-0:5.33-20.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/file@5.33-20.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "file-devel-0:5.33-20.el8.tuxcare.els1.x86_64", "product": { "name": "file-devel-0:5.33-20.el8.tuxcare.els1.x86_64", "product_id": "file-devel-0:5.33-20.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/file-devel@5.33-20.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "file-libs-0:5.33-20.el8.tuxcare.els1.x86_64", "product": { "name": "file-libs-0:5.33-20.el8.tuxcare.els1.x86_64", "product_id": "file-libs-0:5.33-20.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/file-libs@5.33-20.el8.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "python3-magic-0:5.33-20.el8.tuxcare.els1.noarch", "product": { "name": "python3-magic-0:5.33-20.el8.tuxcare.els1.noarch", "product_id": "python3-magic-0:5.33-20.el8.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/python3-magic@5.33-20.el8.tuxcare.els1?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "pam-0:1.3.1-14.el8.tuxcare.els2.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els2.i686" }, "product_reference": "pam-0:1.3.1-14.el8.tuxcare.els2.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-0:1.3.1-14.el8.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-0:1.3.1-14.el8.i686" }, "product_reference": "pam-0:1.3.1-14.el8.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-0:1.3.1-14.el8.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els2.x86_64" }, "product_reference": "pam-0:1.3.1-14.el8.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-0:1.3.1-14.el8.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-0:1.3.1-14.el8.x86_64" }, "product_reference": "pam-0:1.3.1-14.el8.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-0:1.3.1-14.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els1.x86_64" }, "product_reference": "pam-0:1.3.1-14.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-0:1.3.1-14.el8.tuxcare.els1.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els1.i686" }, "product_reference": "pam-0:1.3.1-14.el8.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686" }, "product_reference": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-devel-0:1.3.1-14.el8.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-devel-0:1.3.1-14.el8.i686" }, "product_reference": "pam-devel-0:1.3.1-14.el8.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64" }, "product_reference": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-devel-0:1.3.1-14.el8.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-devel-0:1.3.1-14.el8.x86_64" }, "product_reference": "pam-devel-0:1.3.1-14.el8.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686" }, "product_reference": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64" }, "product_reference": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "tar-2:1.30-5.el8.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els2.x86_64" }, "product_reference": "tar-2:1.30-5.el8.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "tar-2:1.30-5.el8.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:tar-2:1.30-5.el8.x86_64" }, "product_reference": "tar-2:1.30-5.el8.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "tar-2:1.30-5.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els1.x86_64" }, "product_reference": "tar-2:1.30-5.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-0:5.33-20.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-0:5.33-20.el8.tuxcare.els1.x86_64" }, "product_reference": "file-0:5.33-20.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-0:5.33-20.el8.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-0:5.33-20.el8.x86_64" }, "product_reference": "file-0:5.33-20.el8.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-devel-0:5.33-20.el8.tuxcare.els1.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.i686" }, "product_reference": "file-devel-0:5.33-20.el8.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-devel-0:5.33-20.el8.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-devel-0:5.33-20.el8.i686" }, "product_reference": "file-devel-0:5.33-20.el8.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-devel-0:5.33-20.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.x86_64" }, "product_reference": "file-devel-0:5.33-20.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-devel-0:5.33-20.el8.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-devel-0:5.33-20.el8.x86_64" }, "product_reference": "file-devel-0:5.33-20.el8.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-magic-0:5.33-20.el8.tuxcare.els1.noarch as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:python3-magic-0:5.33-20.el8.tuxcare.els1.noarch" }, "product_reference": "python3-magic-0:5.33-20.el8.tuxcare.els1.noarch", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-magic-0:5.33-20.el8.noarch as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:python3-magic-0:5.33-20.el8.noarch" }, "product_reference": "python3-magic-0:5.33-20.el8.noarch", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-libs-0:5.33-20.el8.tuxcare.els1.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.i686" }, "product_reference": "file-libs-0:5.33-20.el8.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-libs-0:5.33-20.el8.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-libs-0:5.33-20.el8.i686" }, "product_reference": "file-libs-0:5.33-20.el8.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-libs-0:5.33-20.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.x86_64" }, "product_reference": "file-libs-0:5.33-20.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-libs-0:5.33-20.el8.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-libs-0:5.33-20.el8.x86_64" }, "product_reference": "file-libs-0:5.33-20.el8.x86_64", "relates_to_product_reference": "CentOS-8.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-24783", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "description", "text": "Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "CentOS-8.4:file-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-0:5.33-20.el8.x86_64", "CentOS-8.4:file-devel-0:5.33-20.el8.i686", "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.i686", "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-devel-0:5.33-20.el8.x86_64", "CentOS-8.4:file-libs-0:5.33-20.el8.i686", "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.i686", "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-libs-0:5.33-20.el8.x86_64", "CentOS-8.4:pam-0:1.3.1-14.el8.i686", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els1.i686", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els1.x86_64", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els2.i686", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els2.x86_64", "CentOS-8.4:pam-0:1.3.1-14.el8.x86_64", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.i686", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.x86_64", "CentOS-8.4:python3-magic-0:5.33-20.el8.noarch", "CentOS-8.4:python3-magic-0:5.33-20.el8.tuxcare.els1.noarch", "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els1.x86_64", "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els2.x86_64", "CentOS-8.4:tar-2:1.30-5.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-24783" } ], "release_date": "2024-03-05T00:00:00Z", "remediations": [ { "category": "no_fix_planned", "details": "- Exposure is limited to cases where a peer presents a certificate chain with an unknown public key algorithm; on servers this only applies if mutual TLS client certificate verification is explicitly enabled (VerifyClientCertIfGiven or RequireAndVerifyClientCert), which is not the default. \n- Successful exploitation requires control of the TLS peer or traffic to deliver a specially crafted chain and results in a verification panic (connection denial-of-service) rather than data exposure, code execution, or a trust bypass. \n- In centrally managed VM/server deployments that use standard CA chains (RSA/ECDSA/Ed25519) and server-only TLS, the practical likelihood and impact are low, so this CVE can be safely deprioritized.", "product_ids": [ "CentOS-8.4:file-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-0:5.33-20.el8.x86_64", "CentOS-8.4:file-devel-0:5.33-20.el8.i686", "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.i686", "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-devel-0:5.33-20.el8.x86_64", "CentOS-8.4:file-libs-0:5.33-20.el8.i686", "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.i686", "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-libs-0:5.33-20.el8.x86_64", "CentOS-8.4:pam-0:1.3.1-14.el8.i686", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els1.i686", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els1.x86_64", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els2.i686", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els2.x86_64", "CentOS-8.4:pam-0:1.3.1-14.el8.x86_64", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.i686", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.x86_64", "CentOS-8.4:python3-magic-0:5.33-20.el8.noarch", "CentOS-8.4:python3-magic-0:5.33-20.el8.tuxcare.els1.noarch", "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els1.x86_64", "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els2.x86_64", "CentOS-8.4:tar-2:1.30-5.el8.x86_64" ] }, { "category": "no_fix_planned", "details": "This flaw triggers a panic in Go’s certificate verification only when processing a chain that uses an unknown/unsupported public‑key algorithm, so the realistic impact is limited to a process crash (availability) rather than data exposure, code execution, or certificate forgery. Server‑side exploitation requires an explicitly non‑default TLS setting that verifies client certificates (VerifyClientCertIfGiven or RequireAndVerifyClientCert), while client‑side exploitation requires connecting to an endpoint that serves a deliberately crafted, non‑standard certificate chain—both conditions that raise attack complexity. Given these prerequisites and the absence of confidentiality or integrity impact in typical enterprise VM/server deployments, this issue can be safely deprioritized.", "product_ids": [ "CentOS-8.4:file-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-0:5.33-20.el8.x86_64", "CentOS-8.4:file-devel-0:5.33-20.el8.i686", "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.i686", "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-devel-0:5.33-20.el8.x86_64", "CentOS-8.4:file-libs-0:5.33-20.el8.i686", "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.i686", "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-libs-0:5.33-20.el8.x86_64", "CentOS-8.4:pam-0:1.3.1-14.el8.i686", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els1.i686", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els1.x86_64", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els2.i686", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els2.x86_64", "CentOS-8.4:pam-0:1.3.1-14.el8.x86_64", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.i686", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.x86_64", "CentOS-8.4:python3-magic-0:5.33-20.el8.noarch", "CentOS-8.4:python3-magic-0:5.33-20.el8.tuxcare.els1.noarch", "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els1.x86_64", "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els2.x86_64", "CentOS-8.4:tar-2:1.30-5.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CentOS-8.4:file-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-0:5.33-20.el8.x86_64", "CentOS-8.4:file-devel-0:5.33-20.el8.i686", "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.i686", "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-devel-0:5.33-20.el8.x86_64", "CentOS-8.4:file-libs-0:5.33-20.el8.i686", "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.i686", "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-libs-0:5.33-20.el8.x86_64", "CentOS-8.4:pam-0:1.3.1-14.el8.i686", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els1.i686", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els1.x86_64", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els2.i686", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els2.x86_64", "CentOS-8.4:pam-0:1.3.1-14.el8.x86_64", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.i686", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.x86_64", "CentOS-8.4:python3-magic-0:5.33-20.el8.noarch", "CentOS-8.4:python3-magic-0:5.33-20.el8.tuxcare.els1.noarch", "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els1.x86_64", "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els2.x86_64", "CentOS-8.4:tar-2:1.30-5.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }