{"id":"CVE-2024-21646","aliases":["AZL-33284","AZL-34555","DEBIAN-CVE-2024-21646","EUVD-2024-19279","GHSA-j29m-p99g-7hpv","SUSE-SU-2024:0323-1","UBUNTU-CVE-2024-21646","openSUSE-SU-2024:13643-1"],"status":"published","title":"Azure IoT Platform Device SDK Remote Code Execution Vulnerability","description":"Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication.  When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution.  This vulnerability has been patched in release 2024-01-01.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0511,"percentile":0.92481,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-94"],"published":"2024-01-09T00:04:53Z","modified":"2026-11-02T12:00:32Z","fixes":[{"ecosystem":"Azure Linux:2","package":"azure-iot-sdk-c","fixed_in":["2022.01.21-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"azure-iot-sdk-c","fixed_in":["2024.03.04-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"azure-uamqp-python","fixed_in":["1.6.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"azure-uamqp-python","fixed_in":["1.6.8-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"python-uamqp","fixed_in":["1.5.3-150100.4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"python-uamqp","fixed_in":["1.5.3-150100.4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-uamqp","fixed_in":["1.5.3-150100.4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"python-uamqp","fixed_in":["1.5.3-150100.4.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python-uamqp","fixed_in":["1.5.3-150100.4.10.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"azure-iot-sdk-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.01.21-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"azure-iot-sdk-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.03.04-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"azure-uamqp-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.3-1","1.6.10-1","1.6.11-1","1.6.11-2","1.6.4-1","1.6.5-1","1.6.5-2","1.6.8-1","1.6.8-2","1.6.9-1","1.6.9-2","1.6.9-3"]},{"source":"osv","ecosystem":"Debian:13","package":"azure-uamqp-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"azure-uamqp-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"python-uamqp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150100.4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"python-uamqp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150100.4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-uamqp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150100.4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"python-uamqp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150100.4.10.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-uamqp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150100.4.10.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"azure-uamqp-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.6-1","1.2.6-2","1.2.6-4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"azure-uamqp-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.13-1","1.4.3-1","1.4.3-1ubuntu1","1.5.0-1","1.5.1-1","1.5.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"azure-uamqp-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.5-1","1.6.5-1build1","1.6.5-2","1.6.8-1","1.6.8-2","1.6.8-2build1"]}],"products":[{"vendor":"azure","product":"azure-uamqp-c"},{"vendor":"microsoft","product":"azure_uamqp"}],"references":[{"url":"https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-j29m-p99g-7hpv","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://github.com/Azure/azure-uamqp-c/commit/12ddb3a31a5a97f55b06fa5d74c59a1d84ad78fe","tags":["x_refsource_MISC","x_transferred","Patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21646","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21646.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-21646","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240323-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219409","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21646","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-21646","tags":["report"]},{"url":"https://github.com/Azure/azure-uamqp-python/issues/372","tags":["report"]},{"url":"https://github.com/Azure/azure-uamqp-python/commit/c85efcd12c249999eb8a1064b7d4fd8c7715c780","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21646","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-21646","title":"Azure IoT Platform Device SDK Remote Code Execution Vulnerability","description":"Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication.  When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution.  This vulnerability has been patched in release 2024-01-01.","status":"published","published":"2024-01-09T00:04:53.587Z","modified":"2025-06-16T19:52:58.874Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:05.077718Z"}],"euvd":[{"id":"EUVD-2024-19279","description":"Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication.  When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution.  This vulnerability has been patched in release 2024-01-01.","status":"published","published":"2024-01-09T00:04:53Z","modified":"2025-06-16T19:52:58Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:23.224988Z"}],"nvd":[{"id":"CVE-2024-21646","description":"Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication.  When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution.  This vulnerability has been patched in release 2024-01-01.","status":"published","published":"2024-01-09T01:15:38.937Z","modified":"2026-06-17T07:09:55.18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-94","CWE-190"],"updated_at":"2026-11-02T14:09:30.070039Z"}],"osv":[{"id":"AZL-33284","title":"CVE-2024-21646 affecting package azure-iot-sdk-c for versions less than 2022.01.21-2","description":"Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication.  When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution.  This vulnerability has been patched in release 2024-01-01.","status":"published","published":"2024-01-09T01:15:38Z","modified":"2026-04-21T04:26:46.180164Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-34555","title":"CVE-2024-21646 affecting package azure-iot-sdk-c for versions less than 2024.03.04-1","description":"Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication.  When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution.  This vulnerability has been patched in release 2024-01-01.","status":"published","published":"2024-01-09T01:15:38Z","modified":"2026-04-21T04:33:35.736283Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"CVE-2024-21646","title":"Azure IoT Platform Device SDK Remote Code Execution Vulnerability","description":"Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication.  When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution.  This vulnerability has been patched in release 2024-01-01.","status":"published","published":"2024-01-09T00:04:53.587Z","modified":"2026-10-28T10:40:02.524223437Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"DEBIAN-CVE-2024-21646","description":"Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication.  When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution.  This vulnerability has been patched in release 2024-01-01.","status":"published","published":"2024-01-09T01:15:38.937Z","modified":"2026-11-02T12:00:32.873722078Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"UBUNTU-CVE-2024-21646","description":"Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication.  When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution.  This vulnerability has been patched in release 2024-01-01.","status":"published","published":"2024-01-09T01:15:00Z","modified":"2025-10-24T05:06:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"openSUSE-SU-2024:13643-1","title":"python310-uamqp-1.6.8-1.1 on GA media","description":"These are all security issues fixed in the python310-uamqp-1.6.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:24:34.765895Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2024:0323-1","title":"Security update for python-uamqp","description":"This update for python-uamqp fixes the following issues:\n\n- CVE-2024-21646: Fix integer overflow which may cause remote code execution (bsc#1219409).\n","status":"published","published":"2024-02-05T08:16:05Z","modified":"2026-02-04T02:15:42.985851Z","updated_at":"2026-11-02T15:53:54.239786Z"}]}}