PatchTheCVEopenafs vulnerabilities and fixes
Recent CVEs affecting openafs, with upgrade or downgrade steps. 3 tracked.
openafs has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2024-11-14. Highest priority: CVE-2024-10397 (score 36/100).
- CVE-2024-10397 HIGH 7.8 UPGRADE A malicious server can crash the OpenAFS cache manager and other client utilities, and possibly execute arbitr
- CVE-2024-10396 MEDIUM 6.5 UPGRADE An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to
- CVE-2024-10394 HIGH 7.8 UPGRADE A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, a
FAQ
How do I fix openafs vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is openafs being exploited right now?
None of the tracked openafs CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which openafs CVE should I patch first?
CVE-2024-10397 currently ranks highest (36/100): A malicious server can crash the OpenAFS cache manager and other client utilities, and possibly execute arbitr.