CVE-2024-38525: dd-trace-cpp malformed unicode header values may cause crash
dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann JSON library. However, due to the way the JSON library is invoked, it throws an uncaught exception, which results in a crash. This vulnerability has been patched in version 0.2.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38525?
CVE-2024-38525 is classified as a medium severity vulnerability due to potential information disclosure.
How do I fix CVE-2024-38525?
To fix CVE-2024-38525, upgrade dd-trace-cpp to version 0.2.3 or later.
What impact does CVE-2024-38525 have on my application?
CVE-2024-38525 may expose sensitive information through logged data when malformed unicode is processed.
Which versions of dd-trace-cpp are affected by CVE-2024-38525?
Versions of dd-trace-cpp prior to 0.2.3 are affected by CVE-2024-38525.
Is CVE-2024-38525 exploitable remotely?
CVE-2024-38525 is not directly exploitable remotely but may lead to information leakage in certain configurations.