一、漏洞信息

漏洞编号：[CVE-2024-25110](https://nvd.nist.gov/vuln/detail/CVE-2024-25110)

漏洞归属组件：[python-amqp](https://gitee.com/src-openeuler/python-amqp)

漏洞归属的版本：2.3.2,2.4.0,5.0.2,5.0.5,5.0.9,5.1.1,5.2.0

漏洞简述：

The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities, a memory allocation may fail causing a use-after-free issue and if a client called it during connection communication it may cause a remote code execution. Users are advised to update the submodule with commit `30865c9c`. There are no known workarounds for this vulnerability.

漏洞公开时间：2024-02-13 04:15:08

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-25110

<details>

<summary>更多参考(点击展开)</summary>

无

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

其它

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(5.2.0):

2.openEuler-20.03-LTS-SP4(5.0.5):

3.openEuler-22.03-LTS-SP1(5.0.9):

4.openEuler-22.03-LTS-SP3(5.0.9):

5.openEuler-22.03-LTS-SP4(5.0.9):

6.openEuler-24.03-LTS(5.1.1):

7.openEuler-24.03-LTS-Next(5.1.1):

修复是否涉及abi变化(是/否)：

1.master(5.2.0):

2.openEuler-20.03-LTS-SP4(5.0.5):

3.openEuler-22.03-LTS-SP1(5.0.9):

4.openEuler-22.03-LTS-SP3(5.0.9):

5.openEuler-22.03-LTS-SP4(5.0.9):

6.openEuler-24.03-LTS(5.1.1):

7.openEuler-24.03-LTS-Next(5.1.1):