CVE-2024-45412 Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack
Remote attackers can cause denial of service in Yeti by sending Unicode payloads that trigger expensive normalization on Windows systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-45412?
CVE-2024-45412 is a medium-severity denial of service vulnerability in yeti-platform yeti, published on 10 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial of service with attacks such as One Million Unicode payload. This can get worse with the use of special Unicode characters like U+2100 (℀), or U+2105 (℅) which could lead the payload size to be tripled. Versions prior to 2.1.11 are affected by this vulnerability. The patch is included in 2.1.11.
Weakness: CWE-770
Which versions are affected by CVE-2024-45412?
It affects 1 product.
Products include Yeti-Platform Yeti.
How do I fix CVE-2024-45412?
No fix has been published for CVE-2024-45412 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-45412 being exploited?
There is no known exploitation of CVE-2024-45412 in the wild and no public exploit code.
Other vulnerabilities in yeti-platform yeti
Sources
Also known as GHSA-cwwm-pq9x-2cxv.