{ "document": { "aggregate_severity": { "text": "Medium" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos8.4els/vex/2024/cve-2024-24786-els_os-centos8_4els.json" } ], "tracking": { "current_release_date": "2026-04-10T19:37:06Z", "generator": { "date": "2026-04-10T19:37:06Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2024-24786-ELS_OS-CENTOS8.4ELS", "initial_release_date": "2024-03-05T00:00:00Z", "revision_history": [ { "date": "2024-03-05T00:00:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-04-08T20:33:42Z", "number": "2", "summary": "Official Publication" }, { "date": "2026-04-10T19:37:06Z", "number": "3", "summary": "Update document" } ], "status": "final", "version": "3" }, "title": "Security update on CVE-2024-24786" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "tar-2:1.30-5.el8.x86_64", "product": { "name": "tar-2:1.30-5.el8.x86_64", "product_id": "tar-2:1.30-5.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/tar@1.30-5.el8?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "file-0:5.33-20.el8.x86_64", "product": { "name": "file-0:5.33-20.el8.x86_64", "product_id": "file-0:5.33-20.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/file@5.33-20.el8?arch=x86_64" } } }, { "category": "product_version", "name": "file-devel-0:5.33-20.el8.x86_64", "product": { "name": "file-devel-0:5.33-20.el8.x86_64", "product_id": "file-devel-0:5.33-20.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/file-devel@5.33-20.el8?arch=x86_64" } } }, { "category": "product_version", "name": "file-libs-0:5.33-20.el8.x86_64", "product": { "name": "file-libs-0:5.33-20.el8.x86_64", "product_id": "file-libs-0:5.33-20.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/file-libs@5.33-20.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "file-devel-0:5.33-20.el8.i686", "product": { "name": "file-devel-0:5.33-20.el8.i686", "product_id": "file-devel-0:5.33-20.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/file-devel@5.33-20.el8?arch=i686" } } }, { "category": "product_version", "name": "file-libs-0:5.33-20.el8.i686", "product": { "name": "file-libs-0:5.33-20.el8.i686", "product_id": "file-libs-0:5.33-20.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/file-libs@5.33-20.el8?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "python3-magic-0:5.33-20.el8.noarch", "product": { "name": "python3-magic-0:5.33-20.el8.noarch", "product_id": "python3-magic-0:5.33-20.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/centos/python3-magic@5.33-20.el8?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 8.4", "product": { "name": "Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:8.4:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "tar-2:1.30-5.el8.tuxcare.els2.x86_64", "product": { "name": "tar-2:1.30-5.el8.tuxcare.els2.x86_64", "product_id": "tar-2:1.30-5.el8.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/tar@1.30-5.el8.tuxcare.els2?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "tar-2:1.30-5.el8.tuxcare.els1.x86_64", "product": { "name": "tar-2:1.30-5.el8.tuxcare.els1.x86_64", "product_id": "tar-2:1.30-5.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/tar@1.30-5.el8.tuxcare.els1?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "file-0:5.33-20.el8.tuxcare.els1.x86_64", "product": { "name": "file-0:5.33-20.el8.tuxcare.els1.x86_64", "product_id": "file-0:5.33-20.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/file@5.33-20.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "file-devel-0:5.33-20.el8.tuxcare.els1.x86_64", "product": { "name": "file-devel-0:5.33-20.el8.tuxcare.els1.x86_64", "product_id": "file-devel-0:5.33-20.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/file-devel@5.33-20.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "file-libs-0:5.33-20.el8.tuxcare.els1.x86_64", "product": { "name": "file-libs-0:5.33-20.el8.tuxcare.els1.x86_64", "product_id": "file-libs-0:5.33-20.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/file-libs@5.33-20.el8.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "file-devel-0:5.33-20.el8.tuxcare.els1.i686", "product": { "name": "file-devel-0:5.33-20.el8.tuxcare.els1.i686", "product_id": "file-devel-0:5.33-20.el8.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/file-devel@5.33-20.el8.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "file-libs-0:5.33-20.el8.tuxcare.els1.i686", "product": { "name": "file-libs-0:5.33-20.el8.tuxcare.els1.i686", "product_id": "file-libs-0:5.33-20.el8.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/file-libs@5.33-20.el8.tuxcare.els1?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "python3-magic-0:5.33-20.el8.tuxcare.els1.noarch", "product": { "name": "python3-magic-0:5.33-20.el8.tuxcare.els1.noarch", "product_id": "python3-magic-0:5.33-20.el8.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/python3-magic@5.33-20.el8.tuxcare.els1?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tar-2:1.30-5.el8.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els2.x86_64" }, "product_reference": "tar-2:1.30-5.el8.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "tar-2:1.30-5.el8.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:tar-2:1.30-5.el8.x86_64" }, "product_reference": "tar-2:1.30-5.el8.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "tar-2:1.30-5.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els1.x86_64" }, "product_reference": "tar-2:1.30-5.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-0:5.33-20.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-0:5.33-20.el8.tuxcare.els1.x86_64" }, "product_reference": "file-0:5.33-20.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-0:5.33-20.el8.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-0:5.33-20.el8.x86_64" }, "product_reference": "file-0:5.33-20.el8.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-devel-0:5.33-20.el8.tuxcare.els1.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.i686" }, "product_reference": "file-devel-0:5.33-20.el8.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-devel-0:5.33-20.el8.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-devel-0:5.33-20.el8.i686" }, "product_reference": "file-devel-0:5.33-20.el8.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-devel-0:5.33-20.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.x86_64" }, "product_reference": "file-devel-0:5.33-20.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-devel-0:5.33-20.el8.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-devel-0:5.33-20.el8.x86_64" }, "product_reference": "file-devel-0:5.33-20.el8.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-magic-0:5.33-20.el8.tuxcare.els1.noarch as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:python3-magic-0:5.33-20.el8.tuxcare.els1.noarch" }, "product_reference": "python3-magic-0:5.33-20.el8.tuxcare.els1.noarch", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-magic-0:5.33-20.el8.noarch as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:python3-magic-0:5.33-20.el8.noarch" }, "product_reference": "python3-magic-0:5.33-20.el8.noarch", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-libs-0:5.33-20.el8.tuxcare.els1.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.i686" }, "product_reference": "file-libs-0:5.33-20.el8.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-libs-0:5.33-20.el8.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-libs-0:5.33-20.el8.i686" }, "product_reference": "file-libs-0:5.33-20.el8.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-libs-0:5.33-20.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.x86_64" }, "product_reference": "file-libs-0:5.33-20.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "file-libs-0:5.33-20.el8.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:file-libs-0:5.33-20.el8.x86_64" }, "product_reference": "file-libs-0:5.33-20.el8.x86_64", "relates_to_product_reference": "CentOS-8.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-24786", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition ('Infinite Loop')" }, "notes": [ { "category": "description", "text": "The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "CentOS-8.4:file-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-0:5.33-20.el8.x86_64", "CentOS-8.4:file-devel-0:5.33-20.el8.i686", "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.i686", "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-devel-0:5.33-20.el8.x86_64", "CentOS-8.4:file-libs-0:5.33-20.el8.i686", "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.i686", "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-libs-0:5.33-20.el8.x86_64", "CentOS-8.4:python3-magic-0:5.33-20.el8.noarch", "CentOS-8.4:python3-magic-0:5.33-20.el8.tuxcare.els1.noarch", "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els1.x86_64", "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els2.x86_64", "CentOS-8.4:tar-2:1.30-5.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-24786" } ], "release_date": "2024-03-05T00:00:00Z", "remediations": [ { "category": "no_fix_planned", "details": "This issue is a denial-of-service in Go’s protobuf JSON decoder that only occurs when an application uses protojson.Unmarshal on attacker-controlled JSON and either unmarshals into a type containing google.protobuf.Any or explicitly enables the non-default UnmarshalOptions.DiscardUnknown. Services that use Protobuf’s normal binary wire format (such as standard gRPC) or otherwise avoid these specific JSON code paths are not affected, and there is no confidentiality or integrity impact. Given the narrow, non-default preconditions and availability-only outcome, this can be safely deprioritized in managed server/VM environments.", "product_ids": [ "CentOS-8.4:file-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-0:5.33-20.el8.x86_64", "CentOS-8.4:file-devel-0:5.33-20.el8.i686", "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.i686", "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-devel-0:5.33-20.el8.x86_64", "CentOS-8.4:file-libs-0:5.33-20.el8.i686", "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.i686", "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-libs-0:5.33-20.el8.x86_64", "CentOS-8.4:python3-magic-0:5.33-20.el8.noarch", "CentOS-8.4:python3-magic-0:5.33-20.el8.tuxcare.els1.noarch", "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els1.x86_64", "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els2.x86_64", "CentOS-8.4:tar-2:1.30-5.el8.x86_64" ] }, { "category": "no_fix_planned", "details": "This vulnerability is limited to application-level denial of service with no confidentiality or integrity impact. Exploitation requires a Go service that specifically uses google.golang.org/protobuf’s protojson.Unmarshal (versions prior to 1.33.0) on attacker-supplied JSON into messages containing google.protobuf.Any or with UnmarshalOptions.DiscardUnknown enabled; services using binary Protobuf or other JSON decoders are unaffected. Given the narrow preconditions, high attack complexity, and impact confined to process availability, it can be safely deprioritized for centrally managed enterprise VM/server deployments.", "product_ids": [ "CentOS-8.4:file-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-0:5.33-20.el8.x86_64", "CentOS-8.4:file-devel-0:5.33-20.el8.i686", "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.i686", "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-devel-0:5.33-20.el8.x86_64", "CentOS-8.4:file-libs-0:5.33-20.el8.i686", "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.i686", "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-libs-0:5.33-20.el8.x86_64", "CentOS-8.4:python3-magic-0:5.33-20.el8.noarch", "CentOS-8.4:python3-magic-0:5.33-20.el8.tuxcare.els1.noarch", "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els1.x86_64", "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els2.x86_64", "CentOS-8.4:tar-2:1.30-5.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-8.4:file-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-0:5.33-20.el8.x86_64", "CentOS-8.4:file-devel-0:5.33-20.el8.i686", "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.i686", "CentOS-8.4:file-devel-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-devel-0:5.33-20.el8.x86_64", "CentOS-8.4:file-libs-0:5.33-20.el8.i686", "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.i686", "CentOS-8.4:file-libs-0:5.33-20.el8.tuxcare.els1.x86_64", "CentOS-8.4:file-libs-0:5.33-20.el8.x86_64", "CentOS-8.4:python3-magic-0:5.33-20.el8.noarch", "CentOS-8.4:python3-magic-0:5.33-20.el8.tuxcare.els1.noarch", "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els1.x86_64", "CentOS-8.4:tar-2:1.30-5.el8.tuxcare.els2.x86_64", "CentOS-8.4:tar-2:1.30-5.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }