Denial of Service Vulnerabilities in RHEL perl-Archive-Tar and httplib2
Multiple vulnerabilities in Red Hat Enterprise Linux packages perl-Archive-Tar and httplib2 can be exploited by a remote, anonymous attacker to cause a Denial of Service condition.
Red Hat has issued a security advisory regarding vulnerabilities affecting specific packages within the Red Hat Enterprise Linux (RHEL) ecosystem. The vulnerabilities involve perl-Archive-Tar and httplib2, which can be leveraged by a remote, anonymous attacker to induce a Denial of Service (DoS) condition on affected systems. The issue arises due to flaws within these specific libraries that allow for resource exhaustion or process crashes when handling malformed input. Organizations utilizing RHEL systems that rely on these packages for data processing or network communication are at risk of service interruption. Security teams should prioritize patching or updating the affected packages to the versions provided by Red Hat to remediate CVE-2024-39908 and CVE-2024-39909.
Impact
The successful exploitation of these vulnerabilities results in a Denial of Service, which can disrupt critical services or applications relying on the vulnerable RHEL packages. While these vulnerabilities are limited to DoS impact, they can be utilized by unauthorized remote actors to degrade system availability in targeted environments.
Recommendation
Prioritize the identification of RHEL systems running the vulnerable versions of perl-Archive-Tar and httplib2. Apply the security updates provided via the Red Hat errata channels immediately to patch CVE-2024-39908 and CVE-2024-39909. Validate that automated patch management processes are configured to pull the latest updates for RHEL enterprise repositories to ensure coverage for these CVEs.