CVE-2024-35326, CVE-2024-35328, CVE-2024-35329
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 1.2k
- Forks
- 370
- PR merge metrics
- No merged PRs in 30d
Description
The following CVEs I do not consider as vulnerabilties:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35326 https://github.com/idhyt/pocs/blob/main/libyaml/CVE-2024-35326.c
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35328 https://github.com/idhyt/pocs/blob/main/libyaml/CVE-2024-35328.c
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35329 https://github.com/idhyt/pocs/blob/main/libyaml/CVE-2024-35329.c
They are all missing to initialize structs with the according proper functions for that, so there doesn't exist any working code that could be exploited.
I already contacted mitre.org for CVE-2024-35329 over a month ago to reject this, but no reply :(
There has already been some discussion in #298 but I decided to create a new issue because the thread is hard to read because of the discussion of how those CVEs were (not) reported and published.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the three CVE links and their linked libyaml proof-of-concept files first, then read the related discussion in issue #298. Determine whether the reported cases represent exploitable libyaml vulnerabilities and document the evidence and appropriate CVE outcome.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100