CVE-2024-7701

🗓️ 15 Dec 2024 11:15:00Reported by ubuntu.comType

ubuntucve🔗 ubuntu.com👁 156 Views

CVE-2024-7701 is a vulnerability in Unix systems updated on 18 December 2024.

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2024-7701	15 Dec 202410:59	–	circl
CNNVD	Percona Toolkit security vulnerabilities	15 Dec 202400:00	–	cnnvd
CVE	CVE-2024-7701	15 Dec 202410:56	–	cve
Cvelist	CVE-2024-7701 Misuse of SHA256 to create an encryption key	15 Dec 202410:56	–	cvelist
Debian CVE	CVE-2024-7701	15 Dec 202410:56	–	debiancve
EUVD	EUVD-2024-48557	3 Oct 202520:07	–	euvd
Mend	CVE-2024-7701	15 Dec 202410:56	–	mend
NVD	CVE-2024-7701	15 Dec 202411:15	–	nvd
osv_debian	DEBIAN-CVE-2024-7701	15 Dec 202411:15	–	osv_debian
osv_echo	ECHO-A985-43D5-9A0C GHSA-r44j-crv5-q35m / NVD's own CPE match pins this to the single exact version percona-toolkit:3.6.0, with no version range -- the advisory is "unreviewed" and carries no upper bound, so CPE-based scanners (Trivy/Grype/Wiz) treat it as affecting every later version too. The vulnerable code (weak SHA-256-as-KDF password hashing in src/go/pt-secure-collect/encrypt.go) was replaced with a proper HKDF derivation upstream in commit 78f20304 ("Use KDF instead of hash"), first shipped in v3.7.0 and present in our v3.7.1 build. Independent of the version question, this package never builds pt-secure-collect at all -- only pt-online-schema-change (a separate Perl tool); the build step explicitly drops the manifypods->gotools coupling so Go tools are never compiled.	8 Oct 202614:59	–	osv_echo

Source	Link
cve	www.cve.org/CVERecord
github	www.github.com/percona/percona-toolkit/blob/aa1ac0e6889168fddf73c3a72d447e9ea0c0c63b/src/go/pt-secure-collect/encrypt.go

18 Dec 2024 01:50Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

CVSS 45.1

EPSS0.00207

SSVC

cve identifier unix systems vulnerability update