docs: latest edit of CVEs (#1391)
docs: cve edited with new template - Added info for insecure instantiation vulnerability - Added info for unsafe deserialization vulnerability - Added KB for CVE about XXE vulnerability - the ones that is fixed with .NET FW 4.6.2 upgrade. Refs: https://github.com/telerik/reporting/issues/1904 https://github.com/telerik/reporting/issues/1930 https://github.com/telerik/reporting/issues/2299 docs: last revision of 2024-4357 Moved 4357 to Report Server docs
This commit is contained in:
Ivan Hristov
GitHub
Родитель
973fafe465
Коммит
c47fc9c97e
|
|
@ -0,0 +1,48 @@
|
|||
---
|
||||
title: Unsafe Deserialization Vulnerability
|
||||
description: "How to mitigate CVE-2024-4200, where an unsafe deserialization may occur in an unpatched version of Telerik Reporting."
|
||||
slug: deserialization-vulnerability-cve-2024-4200
|
||||
res_type: kb
|
||||
---
|
||||
|
||||
## Description
|
||||
|
||||
Product Alert – May 2024 - [CVE-2024-4200](https://www.cve.org/CVERecord?id=CVE-2024-4200)
|
||||
|
||||
- Telerik Reporting 2024 Q1 (18.0.24.305) or earlier.
|
||||
|
||||
## Issue
|
||||
|
||||
CWE-502: Deserialization of Untrusted Data
|
||||
|
||||
In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure deserialization vulnerability.
|
||||
|
||||
### What Are the Impacts
|
||||
|
||||
Local code execution can occur when the Telerik Reporting engine deserializes untrusted localization assets.
|
||||
|
||||
## Solution
|
||||
|
||||
Updating to at least version Reporting 2024 Q2 (18.1.24.514) is the only way to remove this vulnerability. We have addressed the vulnerability and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
|
||||
|
||||
| Current Version | Guidance |
|
||||
|-----------------|----------|
|
||||
| 2024 Q1 (18.0.24.305) or earlier | Update to 2024 Q2 (18.1.24.2.514) ([update instructions](({%slug telerikreporting/upgrade/overview%}))) |
|
||||
|
||||
All customers who have a Telerik Reporting license can access the downloads here [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download?product=REPORTING).
|
||||
|
||||
## Notes
|
||||
|
||||
- This vulnerability takes effect only when replacing one or more Telerik Reporting assets with a custom one containing malicious code. In general, you should never replace localization assets from sources of unknown origin.
|
||||
- To check your current version of Telerik Reporting, there are two primary options:
|
||||
+ If you’re using the REST service, you can visit the `/api/reports/version/` endpoint (e.g., https://demos.telerik.com/reporting/api/reports/version).
|
||||
+ If you’re only using the desktop tooling, check **PC Settings** > **Installed Apps** > expand **Telerik Reporting** item for details.
|
||||
- If you have any questions or concerns related to this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to Telerik customers with an active support plan.
|
||||
|
||||
## External References
|
||||
|
||||
[CVE-2024-4200](https://www.cve.org/CVERecord?id=CVE-2024-4200) (HIGH)
|
||||
|
||||
**CVSS:** 7.7
|
||||
|
||||
In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure deserialization vulnerability
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
---
|
||||
title: Insecure Instantiation Vulnerability
|
||||
description: "How to mitigate CVE-2024-4202, where a custom assembly can be loaded when communicating with remote Reporting engine in an unpatched version of Telerik Reporting."
|
||||
slug: instantiation-vulnerability-cve-2024-4202
|
||||
res_type: kb
|
||||
---
|
||||
|
||||
## Description
|
||||
|
||||
Product Alert – May 2024 - [CVE-2024-4202](https://www.cve.org/CVERecord?id=CVE-2024-4202)
|
||||
|
||||
- Telerik Reporting 2024 Q1 (18.0.24.305) or earlier.
|
||||
|
||||
## Issue
|
||||
|
||||
CWE-94: Improper Control of Generation of Code ('Code Injection')
|
||||
|
||||
In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiation vulnerability.
|
||||
|
||||
### What Are the Impacts
|
||||
|
||||
Local code execution can occur when the Telerik Reporting engine loads a custom assembly as part of the communication workflow between desktop report viewers (WinForms, WPF, WinUI) and a remote Reporting engine.
|
||||
|
||||
## Solution
|
||||
|
||||
Updating to at least version Reporting 2024 Q2 (18.1.24.514) is the only way to remove this vulnerability. We have addressed the vulnerability and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
|
||||
|
||||
| Current Version | Guidance |
|
||||
|-----------------|----------|
|
||||
| 18.0.24.305 (or earlier) | Update to 18.1.24.514 ([update instructions](({%slug telerikreporting/upgrade/overview%}))) |
|
||||
|
||||
All customers who have a Telerik Reporting license can access the downloads here [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download?product=REPORTING).
|
||||
|
||||
## Notes
|
||||
|
||||
- This vulnerability takes effect only when replacing one or more Telerik Reporting assemblies with custom assemblies containing malicious code. In general, you should never replace Telerik Reporting assemblies with assemblies obtained from sources with unknown origins.
|
||||
- To check your current version of Telerik Reporting, there are two primary options:
|
||||
+ If you’re using the REST service, you can visit the `/api/reports/version/` endpoint (e.g., https://demos.telerik.com/reporting/api/reports/version).
|
||||
+ If you’re only using the desktop tooling, check **PC Settings** > **Installed Apps** > expand **Telerik Reporting** item for details.
|
||||
- If you have any questions or concerns related to this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to Telerik customers with an active support plan.
|
||||
|
||||
## External References
|
||||
|
||||
[CVE-2024-4202](https://www.cve.org/CVERecord?id=CVE-2024-4202) (HIGH)
|
||||
|
||||
**CVSS:** 7.7
|
||||
|
||||
In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiation vulnerability.
|
||||
Загрузка…
Ссылка в новой задаче