PatchTheCVEdfinity vulnerabilities
Recent CVEs affecting dfinity products. 2 tracked.
dfinity has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2024-12-09. Highest priority: CVE-2024-7884 (score 44/100).
- CVE-2024-7884 HIGH 7.5 UPGRADE When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by
- CVE-2024-11991 MEDIUM 5.6 UPGRADE Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect
FAQ
How do I fix dfinity vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is dfinity being exploited right now?
None of the tracked dfinity CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which dfinity CVE should I patch first?
CVE-2024-7884 currently ranks highest (44/100): When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by.