CVE-2024-24186

The error classified as CWE-787 (out-of-bounds write) consists of a stack overflow in the IterGetKeysCallback function during input data processing. An attacker can provide specially crafted data that causes excessive recursion depth or writes beyond the stack buffer boundaries. The attack vector is network-based, requires no privileges or user interaction, which significantly lowers the entry threshold for a potential attacker.

Successful exploitation of the vulnerability may lead to taking full control of the system, including violation of confidentiality, integrity, and availability of data — according to the CVSS vector (C:H/I:H/A:H). Arbitrary code execution (RCE) or application destabilization is possible.

Patches available from the vendor should be applied according to the references. It is recommended to monitor the project repository at https://github.com/pcmacdon/jsish to obtain the patched version. Until the fix is applied, consider restricting network access to the Jsish instance.

Jsish v3.5.0 (commit 42c694c)