Stork TLS Certificate Validation Code Flawed, Leading to Potential Data Loss and Denial of Service
CVE-2024-28872

8.1HIGH

Key Information:

Vendor

Isc
Status
Stork
Vendor
CVE Published:
11 July 2024

Badges

👾 Exploit Exists

What is CVE-2024-28872?

The Stork management tool by ISC has a vulnerability in its TLS certificate validation process, which could be exploited by attackers. By obtaining a TLS certificate from the Stork server, an attacker can establish a connection with the Stork agent. This allows the attacker to send malicious commands to services monitored by Stork, such as Kea or BIND 9. The potential repercussions include unauthorized access to sensitive data and service disruption. It's crucial to note that the issue lies specifically with the Stork tool and does not directly affect Kea or BIND 9.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Stork 0.15.0 <= 1.15.0

References

https://kb.isc.org/docs/cve-2024-28872
vendor-advisory

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

JSON
.