<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">CVE-2024-45700</DocumentTitle>
  <DocumentType>SUSE CVE</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE CVE-2024-45700</ID>
    </Identification>
    <Status>Interim</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2025-04-03T23:19:34Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2025-04-03T23:19:34Z</InitialReleaseDate>
    <CurrentReleaseDate>2025-04-03T23:19:34Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf-cve.pl</Engine>
      <Date>2020-12-27T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="CVE" Type="Summary" Ordinal="1" xml:lang="en">CVE-2024-45700</Note>
    <Note Title="Mitre CVE Description" Type="Description" Ordinal="2" xml:lang="en">Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an excessive amount of memory and perform CPU-intensive decompression operations, ultimately leading to a service crash.</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="4" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
  </DocumentNotes>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP4-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP4-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP4-LTSS" CPE="cpe:/o:suse:sles-ltss:12:sp4">SUSE Linux Enterprise Server 12 SP4-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP5-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP5-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5-LTSS" CPE="cpe:/o:suse:sles-ltss:12:sp5">SUSE Linux Enterprise Server 12 SP5-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security" CPE="cpe:/o:suse:sles-ltss-extended-security:12:sp5">SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server Teradata 12 SP3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server Teradata 12 SP3">
        <FullProductName ProductID="SUSE Linux Enterprise Server Teradata 12 SP3" CPE="cpe:/o:suse:sles_teradata:12:sp3">SUSE Linux Enterprise Server Teradata 12 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="zabbix">
      <FullProductName ProductID="zabbix" CPE="cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*">zabbix</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="zabbix-agent">
      <FullProductName ProductID="zabbix-agent">zabbix-agent</FullProductName>
    </Branch>
    <Relationship ProductReference="zabbix-agent" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP4-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP4-LTSS:zabbix-agent">zabbix-agent as a component of SUSE Linux Enterprise Server 12 SP4-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="zabbix" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP4-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP4-LTSS:zabbix">zabbix as a component of SUSE Linux Enterprise Server 12 SP4-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="zabbix-agent" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5-LTSS:zabbix-agent">zabbix-agent as a component of SUSE Linux Enterprise Server 12 SP5-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="zabbix" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5-LTSS:zabbix">zabbix as a component of SUSE Linux Enterprise Server 12 SP5-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="zabbix" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security:zabbix">zabbix as a component of SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security</FullProductName>
    </Relationship>
    <Relationship ProductReference="zabbix" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server Teradata 12 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Server Teradata 12 SP3:zabbix">zabbix as a component of SUSE Linux Enterprise Server Teradata 12 SP3</FullProductName>
    </Relationship>
  </ProductTree>
  <Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an excessive amount of memory and perform CPU-intensive decompression operations, ultimately leading to a service crash.</Note>
    </Notes>
    <CVE>CVE-2024-45700</CVE>
    <ProductStatuses>
      <Status Type="Known Not Affected">
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:zabbix</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:zabbix-agent</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security:zabbix</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5-LTSS:zabbix</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5-LTSS:zabbix-agent</ProductID>
        <ProductID>SUSE Linux Enterprise Server Teradata 12 SP3:zabbix</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
  </Vulnerability>
</cvrfdoc>
