CVE-2024-7264: exploitation status and patch state
CVE-2024-7264 · CVSS 6.5 MEDIUM · EPSS 17%
libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an
ASN.1 Generalized Time field. If given an syntactically incorrect field, the
parser might end up using -1 for the length of the *time fraction*, leading to
a `strlen()` getting performed on a pointer to a heap buffer area that is not
(purposely) null terminated.
This flaw most likely leads to a crash, but can also lead to heap contents
getting returned to the application when
[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.
Is CVE-2024-7264 exploited?
Not in the CISA KEV catalog.
EPSS puts exploitation in the next 30 days at 17%.
Public exploit code: none found in monitored sources.
Which products and versions are affected?
No affected package list recorded here yet.
Is there a patch?
No patch identifier recorded here yet.
What PlainSec published about CVE-2024-7264
PlainSec has not published a story about this CVE.