CVE-2024-49723: Conscrypt and Libcore Vulnerability Leading to Remote Information Disclosure
Summary
CVE-2024-49723: In static of NativeCrypto.java, there is a possible way to obtain clear-text data due to improperly used crypto. Affects platform/external/conscrypt across 2 version ranges.
>= 15:0, < 15:2025-02-01
>= 15-next:0, < 15-next:2025-02-01
Fixed in 15-next:2025-02-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Conscrypt is an open-source library that provides a Java implementation of the TLS/SSL protocols, enhancing the security of Android applications. Libcore, another essential component of the Android ecosystem, provides core libraries for Java, including security features. Both packages are crucial for secure communication and data handling in Android applications. However, a vulnerability in these packages could expose sensitive data due to improper cryptographic practices.
Vulnerability Detail
In the static method of NativeCrypto.java, there exists a flaw that allows for the potential retrieval of clear-text data. This vulnerability arises from the improper use of cryptographic functions, which could lead to remote information disclosure without requiring additional execution privileges. Exploitation of this vulnerability does not necessitate user interaction, making it particularly dangerous for applications relying on these libraries.
How To Fix
Minimum fixed version
15-next:2025-02-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patches as soon as they are available.
Conclusion
The vulnerability identified as CVE-2024-49723 in the Conscrypt and Libcore packages poses a significant risk of remote information disclosure due to improper cryptographic usage. Immediate action is required to update these packages to their patched versions to protect sensitive data and maintain application security.
See every vulnerability recorded for platform/external/conscrypt →
FAQ
CVE-2024-49723 is a vulnerability in the Conscrypt and Libcore packages that allows for potential remote information disclosure due to improper cryptographic practices.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to the exposure of sensitive data, potentially allowing attackers to access clear-text information without needing additional privileges.
No, user interaction is not needed for exploitation, making it a significant risk for applications using the affected libraries.
While there are no specific workarounds, it is crucial to prioritize updating to the patched versions as soon as possible to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/conscrypt.
