CVE-2024-25626: Yocto Project Security Advisory - BitBake/Toaster
First published: Mon Feb 19 2024(Updated: )
Yocto Project is an open source collaboration project that helps developers create custom Linux-based systems regardless of the hardware architecture. In Yocto Projects Bitbake before 2.6.2 (before and included Yocto Project 4.3.1), with the Toaster server (included in bitbake) running, missing input validation allows an attacker to perform a remote code execution in the server's shell via a crafted HTTP request. Authentication is not necessary. Toaster server execution has to be specifically run and is not the default for Bitbake command line builds, it is only used for the Toaster web based user interface to Bitbake. The fix has been backported to the bitbake included with Yocto Project 5.0, 3.1.31, 4.0.16, and 4.3.2.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Yocto Project | <3.1.31 | |
| Yocto Project | >=3.2<4.0.16 | |
| Yocto Project | >=4.1<4.3.2 | |
| Yocto Project | <2.6.2 | |
| Yocto Project | <2.6.2 | |
| Yocto Project | <=4.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-25626?
CVE-2024-25626 is classified as a high-severity vulnerability affecting the Yocto Project.
How do I fix CVE-2024-25626?
To fix CVE-2024-25626, you should update Yocto Project Bitbake to version 2.6.2 or later.
What components are affected by CVE-2024-25626?
CVE-2024-25626 affects Yocto Project versions before 4.3.1, including Bitbake 2.6.2 and Toaster server.
Who is impacted by CVE-2024-25626?
Developers using Yocto Project versions prior to 4.3.1 are impacted by CVE-2024-25626.
Is there a workaround for CVE-2024-25626?
There are no known workarounds for CVE-2024-25626; updating to the latest versions is recommended.
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/source
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup-request
- agent/event
- vendor/linuxfoundation
- canonical/yocto project
- version/yocto project/3.2
- version/yocto project/4.1
- vendor/yocto project