CVE-2024-2758 - Vulnerability Details - OpenCVE

Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00358.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/04/03/16
https://github.com/tempesta-tech/tempesta/security/advisories/GHSA-3xwj-5ch3-q9p4
https://www.cve.org/CVERecord?id=CVE-2024-2758
https://www.kb.cert.org/vuls/id/421644

History

Wed, 28 May 2025 17:00:00 +0000

Type	Values Removed	Values Added
References		https://www.cve.org/CVERecord?id=CVE-2024-2758

Thu, 22 May 2025 02:45:00 +0000

Type	Values Removed	Values Added
References	https://kb.cert.org/vuls/id/421644 https://nvd.nist.gov/vuln/detail/CVE-2024-2758 https://www.cve.org/CVERecord?id=CVE-2024-2758

Wed, 30 Oct 2024 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2024-04-03T17:17:56.307Z

Updated: 2025-02-13T17:46:31.765Z

Reserved: 2024-03-21T12:31:11.759Z

Link: CVE-2024-2758

Vulnrichment

Updated: 2024-08-01T19:25:41.425Z

NVD

Status : Deferred

Published: 2024-04-03T18:15:07.380

Modified: 2026-04-15T00:35:42.020

Link: CVE-2024-2758

Redhat

Severity : Important

Publid Date: 2024-04-03T00:00:00Z

Links: CVE-2024-2758 - Bugzilla

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-2758", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2024-03-21T12:31:11.759Z", "datePublished": "2024-04-03T17:17:56.307Z", "dateUpdated": "2025-02-13T17:46:31.765Z"}, "containers": {"cna": {"title": "CVE-2024-2758", "descriptions": [{"lang": "en", "value": "Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Tempesta", "product": "Tempesta FW", "versions": [{"status": "affected", "version": "0.7.0", "lessThanOrEqual": "0.7.0", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1188: Initialization of a Resource with an Insecure Default"}]}, {"descriptions": [{"lang": "en", "description": "CWE-204: Inadequate Information Flow Control"}]}], "references": [{"url": "https://github.com/tempesta-tech/tempesta/security/advisories/GHSA-3xwj-5ch3-q9p4"}, {"url": "https://www.kb.cert.org/vuls/id/421644"}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/03/16"}], "x_generator": {"engine": "VINCE 2.1.12", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2024-2758"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2024-05-01T18:12:13.569Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-04-03T18:54:02.766108Z", "id": "CVE-2024-2758", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-30T18:29:52.063Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:25:41.425Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/tempesta-tech/tempesta/security/advisories/GHSA-3xwj-5ch3-q9p4", "tags": ["x_transferred"]}, {"url": "https://www.kb.cert.org/vuls/id/421644", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/03/16", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/tempesta-tech/tempesta/security/advisories/GHSA-3xwj-5ch3-q9p4", "tags": ["x_transferred"]}, {"url": "https://www.kb.cert.org/vuls/id/421644", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/03/16", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:25:41.425Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-2758", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-03T18:54:02.766108Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:21.840Z"}}], "cna": {"title": "CVE-2024-2758", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Tempesta", "product": "Tempesta FW", "versions": [{"status": "affected", "version": "0.7.0", "versionType": "custom", "lessThanOrEqual": "0.7.0"}]}], "references": [{"url": "https://github.com/tempesta-tech/tempesta/security/advisories/GHSA-3xwj-5ch3-q9p4"}, {"url": "https://www.kb.cert.org/vuls/id/421644"}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/03/16"}], "x_generator": {"env": "prod", "engine": "VINCE 2.1.12", "origin": "https://cveawg.mitre.org/api/cve/CVE-2024-2758"}, "descriptions": [{"lang": "en", "value": "Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1188: Initialization of a Resource with an Insecure Default"}]}, {"descriptions": [{"lang": "en", "description": "CWE-204: Inadequate Information Flow Control"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2024-04-03T17:17:56.307Z"}}}, "cveMetadata": {"cveId": "CVE-2024-2758", "state": "PUBLISHED", "dateUpdated": "2024-10-30T18:29:52.063Z", "dateReserved": "2024-03-21T12:31:11.759Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2024-04-03T17:17:56.307Z", "assignerShortName": "certcc"}, "dataVersion": "5.1"}