CVE-2024-35255

Description

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

CVSS Metrics

• v4.0•MEDIUM•Score: 6.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
• v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
• v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.83%• Percentile: 56%

Techniques & Countermeasures

• CWE-362•Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected Systems

• chainguard•airflow

  < 2.9.2-r0

• chainguard•airflow-bitnami-compat

  < 2.9.2-r0

• chainguard•argo-cd-2.11

  all

• chainguard•argo-cd-2.13

  < 2.13.0-r1

• chainguard•argo-cd-2.13-compat

  < 2.13.0-r1

• chainguard•argo-cd-2.13-repo-server

  < 2.13.0-r1

• chainguard•argo-events

  < 1.9.2-r1

• chainguard•argo-events-fips

  < 1.9.2-r1

• chainguard•argo-workflows

  < 3.5.7-r2

• chainguard•argo-workflows-fips

  < 3.5.7-r2

• chainguard•bank-vaults

  < 1.20.4-r15

• chainguard•bank-vaults-fips

  < 1.20.4-r12

• chainguard•bank-vaults-template

  < 1.20.4-r15

• chainguard•bank-vaults-template-fips

  < 1.20.4-r12

• chainguard•boring-registry

  < 0.14.0-r3

• chainguard•boring-registry-fips

  < 0.14.0-r5

• chainguard•buildctl

  < 0.14.0-r1

• chainguard•buildkitd

  < 0.14.0-r1

• chainguard•chezmoi

  < 2.49.0-r1

• chainguard•cluster-autoscaler-1.31

  < 1.31.5-r1

• chainguard•cluster-autoscaler-1.32

  < 1.32.0-r1

• chainguard•cluster-autoscaler-1.32-compat

  < 1.32.0-r1

• chainguard•cluster-autoscaler-fips-1.31

  < 1.31.2-r0

• chainguard•cluster-autoscaler-fips-1.31-compat

  < 1.31.2-r0

• chainguard•cluster-autoscaler-fips-1.32

  < 1.32.0-r1

• chainguard•cluster-autoscaler-fips-1.32-compat

  < 1.32.0-r1

• chainguard•cortex

  < 1.17.1-r2

• chainguard•cortex-fips

  < 1.17.1-r4

• chainguard•cosign

  < 2.2.4-r6

• chainguard•cosign-fips

  < 2.2.4-r4

• chainguard•druid

  < 32.0.1-r1

• chainguard•druid-compat

  < 32.0.1-r1

• chainguard•external-secrets-fips

  < 0.9.19-r2

• chainguard•falcoctl

  < 0.8.0-r2

• chainguard•falcoctl-fips

  < 0.8.0-r2

• chainguard•fluent-bit-plugin-loki

  < 3.0.0-r3

• chainguard•flux

  < 2.3.0-r2

• chainguard•flux-image-reflector-controller

  < 0.32.0-r3

• chainguard•flux-image-reflector-controller-iamguarded-compat

  < 0.32.0-r3

• chainguard•flux-kustomize-controller

  < 1.3.0-r4

• chainguard•flux-kustomize-controller-iamguarded-compat

  < 1.3.0-r4

• chainguard•flux-source-controller

  < 1.3.0-r3

• chainguard•flux-source-controller-iamguarded-compat

  < 1.3.0-r3

• chainguard•flyte

  < 1.12.0-r3

• chainguard•fulcio

  < 1.4.5-r4

• chainguard•fulcio-fips

  < 1.4.5-r5

• chainguard•goreleaser

  < 2.0.1-r1

• chainguard•grafana-agent-operator

  < 0.41.1-r1

• chainguard•grafana-mimir

  < 2.12.0-r2

• chainguard•guac

  < 0.7.2-r1

Showing first 50 affected entries in server-rendered view.

References (10)

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255
• https://nvd.nist.gov/vuln/detail/CVE-2024-35255
• https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340
• https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499
• https://github.com/Azure/azure-sdk-for-java/commit/5bf020d6ea056de40e2738e3647a4e06f902c18d
• https://github.com/Azure/azure-sdk-for-js/commit/c6aa75d312ae463e744163cedfd8fc480cc8d492
• https://github.com/Azure/azure-sdk-for-net/commit/9279a4f38bf69b457cfb9b354f210e0a540a5c53
• https://github.com/Azure/azure-sdk-for-python/commit/cb065acd7d0f957327dc4f02d1646d4e51a94178
• https://github.com/advisories/GHSA-m5vv-6r4h-3vj9
• https://pypi.org/project/azure-identity