This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Apache CloudStack fixes 2 critical vulnerabilities
Apache fixes 2 critical vulnerabilities in the Apache CloudStack product with versions 4.18.2.1 and 4.19.0.2. As a temporary fix, access to the server can be restricted to only the ports necessary for proper operation, and the cluster service port (9090 in the default configuration) can be restricted to access from trusted networks or IP addresses only [1].
An unauthenticated remote attacker is allowed to execute code without authorization by sending specially crafted packets to the cluster service port [1][2].
The vulnerability is present in product:
- Apache CloudStack; >=4.0.0, <4.18.2.1; >=4.19.0.0, <4.19.0.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-38346 at cve.org, NVD
- CWE-94 at cwe.mitre.org
The vulnerability was publicly disclosed 5. 7. 2024.
An unauthenticated remote attacker is allowed to execute code without authorization by sending specially crafted packets to the integration API port, even if this service was not enabled in the configuration, in which case it will be available on a random port [1][3].
The vulnerability is present in product:
- Apache CloudStack; >=4.0.0, <4.18.2.1; >=4.19.0.0, <4.19.0.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-39864 at cve.org, NVD
- CWE-665 at cwe.mitre.org
- CWE-94 at cwe.mitre.org
The vulnerability was publicly disclosed 5. 7. 2024.
Links
By CESNET, z.s.p.o. Martin Krajči on 10. 7. 2024.