Vulnerability-Lookup

JVNDB-2026-003909

Vulnerability from jvndb - Published: 2026-02-17 20:46 - Updated:2026-02-17 20:46

Summary

Multiple Vulnerabilities in Hitachi Command Suite products

Details

Multiple vulnerabilities have been found in Hitachi Command Suite products. CVE-2024-38477, CVE-2024-2511

References

Type

URL

	CVE	https://www.cve.org/CVERecord?id=CVE-2024-2511
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-38477

Impacted products

Vendor

Product

	Hitachi, Ltd	Hitachi Compute Systems Manager
	Hitachi, Ltd	Hitachi Device Manager
	Hitachi, Ltd	Hitachi Global Link Manager
	Hitachi, Ltd	Hitachi Replication Manager
	Hitachi, Ltd	Hitachi Tiered Storage Manager
	Hitachi, Ltd	Hitachi Tuning Manager

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-003909.html",
  "dc:date": "2026-02-17T20:46+09:00",
  "dcterms:issued": "2026-02-17T20:46+09:00",
  "dcterms:modified": "2026-02-17T20:46+09:00",
  "description": "Multiple vulnerabilities have been found in Hitachi Command Suite products.\r\n\r\nCVE-2024-38477, CVE-2024-2511",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-003909.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:hitachi:compute_systems_manager",
      "@product": "Hitachi Compute Systems Manager",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:device_manager",
      "@product": "Hitachi Device Manager",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:global_link_manager",
      "@product": "Hitachi Global Link Manager",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:replication_manager",
      "@product": "Hitachi Replication Manager",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:tiered_storage_manager",
      "@product": "Hitachi Tiered Storage Manager",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:tuning_manager",
      "@product": "Hitachi Tuning Manager",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    }
  ],
  "sec:identifier": "JVNDB-2026-003909",
  "sec:references": [
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-2511",
      "@id": "CVE-2024-2511",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-38477",
      "@id": "CVE-2024-38477",
      "@source": "CVE"
    }
  ],
  "title": "Multiple Vulnerabilities in Hitachi Command Suite products"
}

CVE-2024-38477 (GCVE-0-2024-38477)

Vulnerability from cvelistv5 – Published: 2024-07-01 18:16 – Updated: 2025-11-03 21:55

Title

Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request

Summary

null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Severity ?

No CVSS data available.

CWE

CWE-476 - NULL Pointer Dereference

Assigner

apache

References

URL

Tags

	https://httpd.apache.org/security/vulnerabilities…	vendor-advisory
	https://security.netapp.com/advisory/ntap-2024071…

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache HTTP Server	Affected: 2.4.0 , ≤ 2.4.59 (semver)

Credits

Orange Tsai (@orange_8361) from DEVCORE

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-38477",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-22T16:23:13.858578Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-18T18:36:04.103Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:55:44.577Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240712-0001/"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/07/01/10"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Oct/11"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.59",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Orange Tsai (@orange_8361) from DEVCORE"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.\u003cbr\u003eUsers are recommended to upgrade to version 2.4.60, which fixes this issue."
            }
          ],
          "value": "null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.\nUsers are recommended to upgrade to version 2.4.60, which fixes this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-12T14:06:17.790Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240712-0001/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-04-01T12:00:00.000Z",
          "value": "Reported"
        }
      ],
      "title": "Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-38477",
    "datePublished": "2024-07-01T18:16:11.935Z",
    "dateReserved": "2024-06-17T11:11:30.174Z",
    "dateUpdated": "2025-11-03T21:55:44.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-2511 (GCVE-0-2024-2511)

Vulnerability from cvelistv5 – Published: 2024-04-08 13:51 – Updated: 2025-11-03 21:54

Title

Unbounded memory growth with session handling in TLSv1.3

Summary

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.

Severity ?

No CVSS data available.

CWE

CWE-1325 - Improperly Controlled Sequential Memory Allocation

Assigner

openssl

References

URL

Tags

	https://www.openssl.org/news/secadv/20240408.txt	vendor-advisory
	https://github.com/openssl/openssl/commit/e9d7083…	patch
	https://github.com/openssl/openssl/commit/7e4d731…	patch
	https://github.com/openssl/openssl/commit/b52867a…	patch
	https://github.openssl.org/openssl/extended-relea…	patch

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Affected: 3.2.0 , < 3.2.2 (semver) Affected: 3.1.0 , < 3.1.6 (semver) Affected: 3.0.0 , < 3.0.14 (semver) Affected: 1.1.1 , < 1.1.1y (custom)

Credits

Manish Patidar (Hewlett Packard Enterprise) Matt Caswell

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-2511",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-09T15:14:41.481807Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-28T19:21:08.630Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:54:02.419Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "OpenSSL Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20240408.txt"
          },
          {
            "name": "3.2.2 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08"
          },
          {
            "name": "3.1.6 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce"
          },
          {
            "name": "3.0.14 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d"
          },
          {
            "name": "1.1.1y git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/04/08/5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240503-0013/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.2.2",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.1.6",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.14",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1y",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Manish Patidar (Hewlett Packard Enterprise)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Matt Caswell"
        }
      ],
      "datePublic": "2024-04-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: Some non-default TLS server configurations can cause unbounded\u003cbr\u003ememory growth when processing TLSv1.3 sessions\u003cbr\u003e\u003cbr\u003eImpact summary: An attacker may exploit certain server configurations to trigger\u003cbr\u003eunbounded memory growth that would lead to a Denial of Service\u003cbr\u003e\u003cbr\u003eThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\u003cbr\u003ebeing used (but not if early_data support is also configured and the default\u003cbr\u003eanti-replay protection is in use). In this case, under certain conditions, the\u003cbr\u003esession cache can get into an incorrect state and it will fail to flush properly\u003cbr\u003eas it fills. The session cache will continue to grow in an unbounded manner. A\u003cbr\u003emalicious client could deliberately create the scenario for this failure to\u003cbr\u003eforce a Denial of Service. It may also happen by accident in normal operation.\u003cbr\u003e\u003cbr\u003eThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\u003cbr\u003eclients.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\u003cbr\u003e1.0.2 is also not affected by this issue."
            }
          ],
          "value": "Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://www.openssl.org/policies/secpolicy.html"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1325",
              "description": "CWE-1325 Improperly Controlled Sequential Memory Allocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-14T14:56:00.208Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.openssl.org/news/secadv/20240408.txt"
        },
        {
          "name": "3.2.2 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08"
        },
        {
          "name": "3.1.6 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce"
        },
        {
          "name": "3.0.14 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d"
        },
        {
          "name": "1.1.1y git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unbounded memory growth with session handling in TLSv1.3",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2024-2511",
    "datePublished": "2024-04-08T13:51:12.349Z",
    "dateReserved": "2024-03-15T15:33:52.037Z",
    "dateUpdated": "2025-11-03T21:54:02.419Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

JVNDB-2026-003909

CVE-2024-38477 (GCVE-0-2024-38477)

CVE-2024-2511 (GCVE-0-2024-2511)

Tags

Sightings

Nomenclature