CVE-2024-23082
Low risk· EPSS 19%Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
An integer overflow was discovered in ThreeTen Backport v1.6.8 in the parse method of the DateTimeFormatter class. However, multiple third parties dispute the existence of this vulnerability, suggesting the report may be based on an insufficiently robust tool.
Risk Assessment
If the vulnerability exists, it could lead to unexpected application behavior or potential security breaches, but due to the dispute over its authenticity, the risk is uncertain.
Recommendation
It is recommended to monitor official updates for the ThreeTen Backport library and consider temporarily restricting the use of the parse method with untrusted input until the situation is clarified.
Other vulnerabilities in ThreeTen Backport
Original NVD description (English source)
ThreeTen Backport v1.6.8 was discovered to contain an integer overflow via the component org.threeten.bp.format.DateTimeFormatter::parse(CharSequence, ParsePosition). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS