Resource exhaustion in fugit - CVE-2024-43380
Published: December 13, 2024
Vulnerability identifier: #VU101767
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-43380
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to fugit "natural" parser, that turns "every wednesday at 5pm" into "0 17 * * 3", accepted any length of input and went on attempting to parse it, not returning promptly, as expected. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Affected software
fugit
Logstash
IBM License Metric Tool
IBM Cloud Pak for Multicloud Management
IBM Cloud Pak for Watson AIOps
Logstash
IBM License Metric Tool
IBM Cloud Pak for Multicloud Management
IBM Cloud Pak for Watson AIOps
How to mitigate CVE-2024-43380
Install updates from vendor's website.
fugit - update to 1.11.1
Logstash - update to 8.15.1
IBM License Metric Tool - update to 9.2.37
IBM Cloud Pak for Multicloud Management - update to 2.3 Fix Pack 12
IBM Cloud Pak for Watson AIOps - update to 4.7.0
Logstash - update to 8.15.1
IBM License Metric Tool - update to 9.2.37
IBM Cloud Pak for Multicloud Management - update to 2.3 Fix Pack 12
IBM Cloud Pak for Watson AIOps - update to 4.7.0