{"timestamp":"2024-08-26T18:34:30.608642Z","id":"CVE-2024-0217","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"defaultStatus":"unaffected","collectionURL":"https://github.com/PackageKit/PackageKit","packageName":"PackageKit","versions":[{"version":"1.2.0","lessThan":"1.2.7","versionType":"semver","status":"affected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"PackageKit","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"compat-PackageKit08","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"PackageKit","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"PackageKit","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"PackageKit","cpes":["cpe:/o:redhat:enterprise_linux:9"]}]

https://access.redhat.com/security/cve/CVE-2024-0217

https://bugzilla.redhat.com/show_bug.cgi?id=2256624

https://github.com/PackageKit/PackageKit/commit/64278c9127e3333342b56ead99556161f7e86f79

OR
     *cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

https://github.com/PackageKit/PackageKit/commit/64278c9127e3333342b56ead99556161f7e86f79 No Types Assigned

https://github.com/PackageKit/PackageKit/commit/64278c9127e3333342b56ead99556161f7e86f79 Patch

Red Hat, Inc. https://github.com/PackageKit/PackageKit/commit/64278c9127e3333342b56ead99556161f7e86f79 [No types assigned]

NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

NIST CWE-416

OR
     *cpe:2.3:a:packagekit_project:packagekit:*:*:*:*:*:*:*:* versions up to (excluding) 1.2.7

OR
     *cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

https://access.redhat.com/security/cve/CVE-2024-0217 No Types Assigned

https://access.redhat.com/security/cve/CVE-2024-0217 Mitigation, Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2256624 No Types Assigned

https://bugzilla.redhat.com/show_bug.cgi?id=2256624 Issue Tracking, Patch, Third Party Advisory

A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.

Red Hat, Inc. AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Red Hat, Inc. CWE-416

Red Hat, Inc. https://access.redhat.com/security/cve/CVE-2024-0217 [No types assigned]

Red Hat, Inc. https://bugzilla.redhat.com/show_bug.cgi?id=2256624 [No types assigned]