What is GHSA-377p-g8gr-5wpg?

GHSA-377p-g8gr-5wpg is a security advisory published by GitHub Security Advisories with Low severity. LIEF obtain sensitive information via the name parameter

Which CVE IDs does GHSA-377p-g8gr-5wpg cover?

GHSA-377p-g8gr-5wpg covers the following CVE IDs: CVE-2024-31636. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-377p-g8gr-5wpg?

GHSA-377p-g8gr-5wpg has a CVSS v3 base score of 3.9, published by GitHub Security Advisories.

Which products are affected by GHSA-377p-g8gr-5wpg?

GHSA-377p-g8gr-5wpg affects 1 product, including: pip/lief:\u003c 0.15.0.

GHSA-377p-g8gr-5wpgLowCVSS 3.9

LIEF obtain sensitive information via the name parameter

Vendor

GitHub Security Advisories

Published

May 3, 2024

Last Modified

June 6, 2026

🔗 CVE IDs covered (1)

CVE-2024-31636 →

📋 Description

An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.

🎯 Affected products1

pip/lief:< 0.15.0

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2024-31636
https://github.com/lief-project/LIEF/issues/1038
https://github.com/lief-project/LIEF
https://github.com/lief-project/LIEF/commit/307e113f8e00b034f0a5f1baa33e54d636c52ea3
https://github.com/pypa/advisory-database/tree/main/vulns/lief/PYSEC-2024-280.yaml
http://lief.com
https://github.com/advisories/GHSA-377p-g8gr-5wpg