Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to     implement AMQP protocol communication. When clients using this library receive a crafted binary type data,     an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution.
    This vulnerability has been patched in release 2024-01-01. (CVE-2024-21646)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of azure-iot-sdk-c installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-21646 advisory.

  - Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to     implement AMQP protocol communication. When clients using this library receive a crafted binary type data,     an integer overflow or wraparound or memory safety issue can occur and May cause remote code execution.
    This vulnerability has been patched in release 2024-01-01. (CVE-2024-21646)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0323-1 advisory.

  - Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to     implement AMQP protocol communication. When clients using this library receive a crafted binary type data,     an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution.
    This vulnerability has been patched in release 2024-01-01. (CVE-2024-21646)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
227970	Linux Distros Unpatched Vulnerability : CVE-2024-21646	Nessus	Misc.	critical
201713	CBL Mariner 2.0 Security Update: azure-iot-sdk-c (CVE-2024-21646)	Nessus	MarinerOS Local Security Checks	critical
190006	SUSE SLES15 / openSUSE 15 Security Update : python-uamqp (SUSE-SU-2024:0323-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2024-21646

critical

Tenable Plugins

critical

critical

critical