This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Pexip Infinity fixes 2 vulnerabilities
Pexip Infinity fixes 2 vulnerabilities in version 37.0 [1][2]. The vulnerability CVE-2024-12084 originally affects the rsync software, which Pexip Infinity uses, so it is also affected by this vulnerability in a limited form.
An unauthenticated remote attacker can carry out a DoS attack by sending specially crafted signaling messages [1].
The vulnerability is present in product:
- Pexip Infinity; >=29.0, <37.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-30080 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 2. 4. 2025.
An authenticated local attacker can, by writing beyond the memory boundary, potentially cause a DoS attack, unauthorized data overwrite or code execution [2].
The vulnerability is present in product:
- Pexip Infinity; >=36.0, <37.0;
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-12084 at cve.org, NVD
- CWE-122: Heap-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 15. 1. 2025.
Links
By CESNET, z.s.p.o. Martin Krajči on 3. 4. 2025.