Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2024-38439 Details

Description

Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLoginExt in login in etc/uams/uams_pam.c. 2.4.1 and 3.1.19 are also fixed versions.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/Netatalk/netatalk/blob/90d91a9ac9a7d6132ab7620d31c8c23400949206/etc/uams/uams_pam.c#L316 CVEProduct
https://github.com/Netatalk/netatalk/issues/1096 CVEBroken LinkNot Applicable
https://github.com/Netatalk/netatalk/security/advisories/GHSA-8r68-857c-4rqc CVEExploitVendor Advisory
https://lists.debian.org/debian-lts-announce/2024/11/msg00026.html CVE
https://netatalk.io/security/CVE-2024-38439 CVEPatchVendor Advisory

see all 9 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-787Out-of-bounds Write[email protected]
CWE-787Out-of-bounds WriteCISA-ADP

Affected Products

ProductVersions
netatalk netatalk
>= 2.0.0, < 2.4.1
>= 3.0.0, < 3.1.19
3.2.0

CPE

  • cpe:2.3:a:netatalk:netatalk:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netatalk:netatalk:3.2.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

9 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2024-38439
NVD Published Date:
Jun 16, 2024
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]