CVE-2024-34403: Integer Overflow
An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/uriparserto a version that resolves this vulnerability.Fixed in 0.9.8+dfsg-1 - Upgrade
Upgrade
debian/uriparserto a version that resolves this vulnerability.Fixed in 0.9.8+dfsg-2Fixed in 1.0.1+dfsg-1 - Upgrade
Upgrade
alpine/uriparserto a version that resolves this vulnerability.Fixed in 0.9.8-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34403?
CVE-2024-34403 has been classified as a moderate severity vulnerability due to the potential for integer overflow leading to application instability.
How do I fix CVE-2024-34403?
To fix CVE-2024-34403, upgrade uriparser to version 0.9.8 or later, where the integer overflow issue has been addressed.
What software is affected by CVE-2024-34403?
CVE-2024-34403 affects uriparser versions up to and including 0.9.7.
What kind of attack can exploit CVE-2024-34403?
CVE-2024-34403 can be exploited through crafted input strings, leading to potential denial of service or other unintended behavior.
Is there a way to mitigate CVE-2024-34403 if I cannot update?
If updating is not possible, consider implementing input validation to limit the length and format of strings processed by uriparser to mitigate the risk.