CVE-2024-45289: Unbounded allocation in ctl(4) CAM Target Layer

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-12 · updated 2026-06-17
Weakness: CWE-665

Description

The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname. The environment variable name used by fetch(1) to pass the filename to the library was incorrect, in effect ignoring the option. Fetch would still connect to a host presenting a certificate included in the revocation file passed to the --crl option.

Affected products

FreeBSD: from 14.1-release before p6; from 13.4-release before p2; from 13.3-release before p8 — fixed in p2, p6, p8

How to fix

Upgrade to a fixed version: FreeBSD p2, p6, p8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-45289 or the next vulnerability affects your stack