fkie_cve-2024-27322
Vulnerability from fkie_nvd
Published
2024-04-29 13:15
Modified
2025-02-13 18:17
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling a maliciously crafted RDS (R Data Serialization) formatted file or R package to run arbitrary code on an end user’s system when interacted with.
References
6f8de1f0-f67e-45a6-b68f-98777fdb759chttp://www.openwall.com/lists/oss-security/2024/04/29/3
6f8de1f0-f67e-45a6-b68f-98777fdb759chttps://hiddenlayer.com/research/r-bitrary-code-execution/
6f8de1f0-f67e-45a6-b68f-98777fdb759chttps://https://kb.cert.org/vuls/id/238194
6f8de1f0-f67e-45a6-b68f-98777fdb759chttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZLV4OWXZIJ7EFBIWUZADUSHYJTFAQ4D/
6f8de1f0-f67e-45a6-b68f-98777fdb759chttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JVE5FDLFJGTAMOSJ6DREFAODEUBRFWSG/
6f8de1f0-f67e-45a6-b68f-98777fdb759chttps://www.kb.cert.org/vuls/id/238194
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/04/29/3
af854a3a-2127-422b-91ae-364da2661108https://hiddenlayer.com/research/r-bitrary-code-execution/
af854a3a-2127-422b-91ae-364da2661108https://https://kb.cert.org/vuls/id/238194
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZLV4OWXZIJ7EFBIWUZADUSHYJTFAQ4D/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JVE5FDLFJGTAMOSJ6DREFAODEUBRFWSG/
af854a3a-2127-422b-91ae-364da2661108https://www.kb.cert.org/vuls/id/238194
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling a maliciously crafted RDS (R Data Serialization) formatted file or R package to run arbitrary code on an end user\u2019s system when interacted with."
    },
    {
      "lang": "es",
      "value": "La deserializaci\u00f3n de datos que no son de confianza puede ocurrir en el lenguaje de programaci\u00f3n estad\u00edstica R, en cualquier versi\u00f3n desde 1.4.0 hasta 4.4.0 incluida, lo que permite que un archivo con formato RDS (R Data Serialization) creado con fines malintencionados o un paquete R ejecute c\u00f3digo arbitrario en el sistema de un usuario final cuando se interact\u00faa con \u00e9l."
    }
  ],
  "id": "CVE-2024-27322",
  "lastModified": "2025-02-13T18:17:30.000",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "6f8de1f0-f67e-45a6-b68f-98777fdb759c",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-04-29T13:15:30.413",
  "references": [
    {
      "source": "6f8de1f0-f67e-45a6-b68f-98777fdb759c",
      "url": "http://www.openwall.com/lists/oss-security/2024/04/29/3"
    },
    {
      "source": "6f8de1f0-f67e-45a6-b68f-98777fdb759c",
      "url": "https://hiddenlayer.com/research/r-bitrary-code-execution/"
    },
    {
      "source": "6f8de1f0-f67e-45a6-b68f-98777fdb759c",
      "url": "https://https://kb.cert.org/vuls/id/238194"
    },
    {
      "source": "6f8de1f0-f67e-45a6-b68f-98777fdb759c",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZLV4OWXZIJ7EFBIWUZADUSHYJTFAQ4D/"
    },
    {
      "source": "6f8de1f0-f67e-45a6-b68f-98777fdb759c",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JVE5FDLFJGTAMOSJ6DREFAODEUBRFWSG/"
    },
    {
      "source": "6f8de1f0-f67e-45a6-b68f-98777fdb759c",
      "url": "https://www.kb.cert.org/vuls/id/238194"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2024/04/29/3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://hiddenlayer.com/research/r-bitrary-code-execution/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://https://kb.cert.org/vuls/id/238194"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZLV4OWXZIJ7EFBIWUZADUSHYJTFAQ4D/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JVE5FDLFJGTAMOSJ6DREFAODEUBRFWSG/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.kb.cert.org/vuls/id/238194"
    }
  ],
  "sourceIdentifier": "6f8de1f0-f67e-45a6-b68f-98777fdb759c",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "6f8de1f0-f67e-45a6-b68f-98777fdb759c",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.