Use of a broken or risky cryptographic algorithm in Musicshelf - CVE-2024-2365

Vulnerability identifier: #VU106950

CSH Severity: Low

CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-2365

CWE-ID: CWE-327

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due to software uses a weak SHA-1 Message_Digest algorithm within the IsValidPin() function in io\fabric\sdk\android\services\network\PinningTrustManager.java. An attacker with physical access to the system can bypass SSL pinning protection and intercept traffic sent by the application.

Musicshelf
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
Containers Module
openSUSE Leap
APEX Cloud Platform for Microsoft Azure
APEX Cloud Platform for Red Hat OpenShift
docker-stable-bash-completion
docker-stable-debuginfo
docker-stable
docker-stable-zsh-completion
docker-stable-fish-completion
docker-stable-rootless-extras
docker-debuginfo
docker
docker-bash-completion
docker-zsh-completion
docker-rootless-extras
docker-fish-completion

Install updates from vendor's website.

APEX Cloud Platform for Microsoft Azure - update to 01.05.01.00
APEX Cloud Platform for Red Hat OpenShift - update to 03.02.04.00
docker-stable-bash-completion - addressed in versions 24.0.9_ce-1.11.1, 24.0.9_ce-1.32.1, 24.0.9_ce-150000.1.15.1, 24.0.9_ce-150000.1.39.1
docker-stable-debuginfo - addressed in versions 24.0.9_ce-1.11.1, 24.0.9_ce-1.32.1, 24.0.9_ce-150000.1.15.1, 24.0.9_ce-150000.1.39.1
docker-stable - addressed in versions 24.0.9_ce-1.11.1, 24.0.9_ce-1.32.1, 24.0.9_ce-150000.1.15.1, 24.0.9_ce-150000.1.39.1
docker-stable-zsh-completion - addressed in versions 24.0.9_ce-150000.1.15.1, 24.0.9_ce-150000.1.39.1
docker-stable-fish-completion - addressed in versions 24.0.9_ce-150000.1.15.1, 24.0.9_ce-150000.1.39.1
docker-stable-rootless-extras - addressed in versions 24.0.9_ce-150000.1.15.1, 24.0.9_ce-150000.1.39.1
docker-debuginfo - addressed in versions 27.5.1_ce-98.126.1, 27.5.1_ce-150000.218.1
docker - addressed in versions 27.5.1_ce-98.126.1, 27.5.1_ce-150000.218.1
docker-bash-completion - addressed in versions 27.5.1_ce-98.126.1, 27.5.1_ce-150000.218.1
docker-zsh-completion - update to 27.5.1_ce-150000.218.1
docker-rootless-extras - update to 27.5.1_ce-150000.218.1
docker-fish-completion - update to 27.5.1_ce-150000.218.1

• https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Weak_Hashing_Algorithms.md

• Weak cryptographic algorithm in Musicshelf
• SUSE update for docker, docker-stable
• SUSE update for docker, docker-stable
• Dell APEX Cloud Platform for Red Hat OpenShift update for third-party components
• Dell APEX Cloud Platform for Microsoft Azure update for third-party components
• SUSE update for docker-stable
• SUSE update for docker-stable