CVE-2024-42329: JS - Crash on unexpected HTTP server response
The webdriver for the Browser object expects an error object to be initialized when the webdriversessionquery function fails. But this function can fail for various reasons without an error description and then the wd->error will be NULL and trying to read from it will result in a crash.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42329?
CVE-2024-42329 has not been assigned a severity rating yet, but it involves a critical error handling issue in Zabbix's webdriver.
How do I fix CVE-2024-42329?
To mitigate CVE-2024-42329, upgrade Zabbix to version 7.0.5 or later, which addresses the error handling in the webdriver.
What versions of Zabbix are affected by CVE-2024-42329?
CVE-2024-42329 affects Zabbix versions from 7.0.0 to 7.0.4.
What is the main issue with CVE-2024-42329?
The main issue with CVE-2024-42329 is that the webdriver_session_query function can fail without providing an error description, leading to null dereference.
Is there a workaround for CVE-2024-42329?
There is no official workaround for CVE-2024-42329, so it is advisable to upgrade to the patched version as soon as possible.