Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-kpne-1khj-d7hk

Summary An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a Key Usage extension composed of more than two bytes of data. Fort writes this string into a 2-byte buffer without properly sanitizing its length, leading to a buffer overflow.

Aliases

alias	CVE-2024-45237

Fixed_packages

url	pkg:deb/debian/fort-validator@1.5.3-1~deb11u1?distro=trixie
purl	pkg:deb/debian/fort-validator@1.5.3-1~deb11u1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/fort-validator@1.5.3-1~deb11u1%3Fdistro=trixie

url	pkg:deb/debian/fort-validator@1.5.3-1~deb11u2?distro=trixie
purl	pkg:deb/debian/fort-validator@1.5.3-1~deb11u2?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/fort-validator@1.5.3-1~deb11u2%3Fdistro=trixie

url	pkg:deb/debian/fort-validator@1.5.4-1%2Bdeb12u1
purl	pkg:deb/debian/fort-validator@1.5.4-1%2Bdeb12u1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/fort-validator@1.5.4-1%252Bdeb12u1

url	pkg:deb/debian/fort-validator@1.5.4-1%2Bdeb12u1?distro=trixie
purl	pkg:deb/debian/fort-validator@1.5.4-1%2Bdeb12u1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/fort-validator@1.5.4-1%252Bdeb12u1%3Fdistro=trixie

url	pkg:deb/debian/fort-validator@1.6.3-1?distro=trixie
purl	pkg:deb/debian/fort-validator@1.6.3-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/fort-validator@1.6.3-1%3Fdistro=trixie

url	pkg:deb/debian/fort-validator@1.6.6-1?distro=trixie
purl	pkg:deb/debian/fort-validator@1.6.6-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/fort-validator@1.6.6-1%3Fdistro=trixie

url	pkg:deb/debian/fort-validator@1.6.8-1?distro=trixie
purl	pkg:deb/debian/fort-validator@1.6.8-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/fort-validator@1.6.8-1%3Fdistro=trixie

Affected_packages

url pkg:deb/debian/fort-validator@1.5.3-1~deb11u1

purl pkg:deb/debian/fort-validator@1.5.3-1~deb11u1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-3qec-nwqf-kyhp

vulnerability	VCID-7cb9-pbrg-h3ce

vulnerability	VCID-fse5-qjwf-fkgu

vulnerability	VCID-kpne-1khj-d7hk

vulnerability	VCID-v6rp-fvgr-n7c9

vulnerability	VCID-yq5p-yjf8-53hg

vulnerability	VCID-zkgp-7gwh-37bj

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/fort-validator@1.5.3-1~deb11u1

References

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2024-45237

reference_id

reference_type

scores

value	0.00323
scoring_system	epss
scoring_elements	0.55721
published_at	2026-06-11T12:55:00Z

value	0.00323
scoring_system	epss
scoring_elements	0.5584
published_at	2026-06-12T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2024-45237

reference_url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45237
reference_id
reference_type
scores
url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45237

reference_url

https://nicmx.github.io/FORT-validator/CVE.html

reference_id

CVE.html

reference_type

scores

value	9.8
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-08-26T19:34:16Z/

url

https://nicmx.github.io/FORT-validator/CVE.html

reference_url	https://usn.ubuntu.com/7813-1/
reference_id	USN-7813-1
reference_type
scores
url	https://usn.ubuntu.com/7813-1/

Weaknesses

Exploits

Severity_range_score 9.8 - 9.8

Exploitability 0.5

Weighted_severity 4.9

Risk_score 2.5

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-kpne-1khj-d7hk

Vulnerability Instance