Alta Aware — 1570 Potential memory exhaustion attack in gorilla/schema package

Release Date

11th of November 2024.

Overview

Due to a vulnerability in the gorilla/schema Go package, there was a possibility of memory exhaustion that could lead to a denial of service in Alta Video Aware, Alta Video Cameras, and Alta Video Cloud.

Affected Products

Alta Video:
- All Stable upgrade channel versions before 7.1.6.
- All Beta upgrade channel versions before 7.1.0.
Avigilon Cloud-Native Cameras:
- All Stable upgrade Channel versions before 7.1.6.
- All Beta upgrade channel versions before 7.1.0.
Alta Video Cloud: before 31st July 2024.

Unaffected Products

Alta Video:
- All Stable upgrade channel versions after and including 7.1.6.
- All Beta upgrade channel versions after and including 7.1.0.
Avigilon Cloud-Native Cameras:
- All Stable upgrade channel versions after and including 7.1.6.
- All Beta upgrade channel versions after and including 7.1.0.
Alta Video Cloud: from 31st July 2024

Resolution

This issue has been fixed in Alta Video Beta upgrade channel version 7.1.0 and Stable upgrade channel version 7.1.6.

It is highly recommended that all installations running an affected version are upgraded to the latest release as soon as possible. Releases are available to download through the Alta Video User Interface.

A fix was deployed to the Alta Video Cloud on 31st July 2024. Alta Video Cloud customers do not need to take any additional action.

This issue has been fixed in Avigilon Cloud-Native Cameras Beta upgrade channel version 7.1.0 and Stable upgrade channel version 7.1.6.

It is highly recommended that all Avigilon Cloud-Native camera installations running an affected version upgrade to the latest release as soon as possible. Releases are available to download through the Alta Video User Interface for Avigilon Cloud-Native cameras and the Avigilon Cloud-Native Camera Interface for unmanaged cameras.

Vulnerability Information

CVE: CVE-2024-37298.
CVSSv3 score: 7.5 (High)
CVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Mitigations

There are no known mitigations for this issue.

Work arounds

There are no known work arounds for this issue.

Acknowledgements

Issue reported by AlexVasiluta.

Disclosure Timeline

02/07/2024 Issue found
26/07/2024 Root cause established
26/07/2024 Fix identified
31/07/2024 Patched Alta Video Cloud released
28/08/2024 Patched Alta Video (Beta upgrade channel) released
08/10/2024 Patched Alta Video (Stable upgrade channel) released
28/08/2024 Patched Avigilon Cloud-Native Cameras (Beta upgrade channel) released
08/10/2024 Patched Avigilon Cloud-Native Cameras (Stable upgrade channel) released
11/11/2024 Vulnerability publicly disclosed