{"id":"CVE-2024-35255","title":"azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity (CVE-2024…","summary":"A flaw was found in Microsoft's Azure Identity Libraries and the Microsoft Authentication Library (MSAL). The flaw arises from a race condition—a scenario where the timing of events leads to unexpected behavior—during concurrent operations…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":"CWE-362","vendor":"Red Hat","product":"cert-manager operator for Red Hat OpenShift 1.15","affected":["ansible_automation_platform 2","build_of_apache_camel_for_spring_boot 3","build_of_quarkus","integration_camel_k 1","openshift_ai_rhoai","developer_hub_1_3_for_rhel 9","build_of_apache_camel_4_for_quarkus 3","cert_manager_operator_for_red_hat_openshift 1.15"],"patched":["developer_hub_1_3_for_rhel 9","build_of_apache_camel_4_for_quarkus 3","cert_manager_operator_for_red_hat_openshift 1.15"],"published":"2024-07-01","updated":"2026-10-09","sourceUpdated":"2026-10-09T16:33:42+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35255.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35255.json"},{"url":"https://access.redhat.com/security/cve/CVE-2024-35255"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295081"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-35255"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35255"},{"url":"https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499"},{"url":"https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340"},{"url":"https://github.com/advisories/GHSA-m5vv-6r4h-3vj9"},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255"},{"url":"https://access.redhat.com/errata/RHBA-2024:7523"},{"url":"https://access.redhat.com/errata/RHSA-2024:7052"},{"url":"https://access.redhat.com/errata/RHSA-2025:0536"},{"url":"https://github.com/Azure/azure-sdk-for-java/commit/5bf020d6ea056de40e2738e3647a4e06f902c18d"},{"url":"https://github.com/Azure/azure-sdk-for-js/commit/c6aa75d312ae463e744163cedfd8fc480cc8d492"},{"url":"https://github.com/Azure/azure-sdk-for-net/commit/9279a4f38bf69b457cfb9b354f210e0a540a5c53"},{"url":"https://github.com/Azure/azure-sdk-for-python/commit/cb065acd7d0f957327dc4f02d1646d4e51a94178"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.0083,"epssPercentile":0.57359,"aliases":["GHSA-m5vv-6r4h-3vj9","GO-2024-2918","PYSEC-2026-1209"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:51.137Z","slug":"CVE-2024-35255","body":"## Overview\n\nA flaw was found in Microsoft's Azure Identity Libraries and the Microsoft Authentication Library (MSAL). The flaw arises from a race condition—a scenario where the timing of events leads to unexpected behavior—during concurrent operations on shared resources. This can result in privilege escalation, allowing attackers to gain unauthorized access to sensitive information. The vulnerability affects multiple versions of these libraries across various programming languages, including Java, .NET, Node.js, Python, JavaScript, C++, and Go. Microsoft has addressed this issue by releasing updated versions of the affected libraries. Users are strongly advised to upgrade to these patched versions to mitigate potential security risks.\n\n## Vendor advisories\n\n- **RHBA-2024:7523** · Red Hat · fixed in: Red Hat Developer Hub 1.3 for RHEL 9 · released 2024-10-02 · [advisory](https://access.redhat.com/errata/RHBA-2024:7523)\n- **RHSA-2024:7052** · Red Hat · fixed in: Red Hat build of Apache Camel 4 for Quarkus 3 · released 2024-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2024:7052)\n- **RHSA-2025:0536** · Red Hat · fixed in: cert-manager operator for Red Hat OpenShift 1.15 · released 2025-01-21 · [advisory](https://access.redhat.com/errata/RHSA-2025:0536)\n- **Red Hat VEX** · Moderate · affected: Red Hat Ansible Automation Platform 2, Red Hat build of Apache Camel for Spring Boot 3, Red Hat build of Quarkus, Red Hat Integration Camel K 1, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat build of Apache Camel for Spring Boot 3, Red Hat build of Quarkus, Red Hat Integration Camel K 1, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35255.json)\n\n**azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity** — rated Moderate by Red Hat. Released 2024-07-01, updated 2026-10-09.\n\nAffected:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel for Spring Boot 3\n- Red Hat build of Quarkus\n- Red Hat Integration Camel K 1\n- Red Hat OpenShift AI (RHOAI)\n\nFixed:\n\n- Red Hat Developer Hub 1.3 for RHEL 9\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- cert-manager operator for Red Hat OpenShift 1.15\n\nNo fix planned:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel for Spring Boot 3\n- Red Hat build of Quarkus\n- Red Hat Integration Camel K 1\n- Red Hat OpenShift AI (RHOAI)\n\nNot affected:\n\n- Red Hat Developer Hub 1.3 for RHEL 9\n- Exploit Intelligence\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 10\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHBA-2024:7523\nBefore applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update). https://access.redhat.com/errata/RHSA-2024:7052\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift.\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting.\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to… https://access.redhat.com/errata/RHSA-2025:0536\n\n## Package advisory (CVE-2024-35255)\n\nAffected packages:\n\n- `azure-identity < 1.16.1`\n- `@azure/identity < 4.2.1`\n- `com.azure:azure-identity < 1.12.2`\n- `@azure/msal-node >= 2.7.0, < 2.9.2`\n- `Microsoft.Identity.Client >= 4.49.1, < 4.60.4`\n- `github.com/Azure/azure-sdk-for-go/sdk/azidentity < 1.6.0-beta.4.0.20240610221955-50774cd97099`\n- `com.microsoft.azure:msal4j >= 1.14.4-beta, < 1.15.1`\n- `Azure.Identity < 1.11.4`\n- `Microsoft.Identity.Client >= 4.61.0, < 4.61.3`\n\nPatched in:\n\n- `azure-identity 1.16.1`\n- `@azure/identity 4.2.1`\n- `com.azure:azure-identity 1.12.2`\n- `@azure/msal-node 2.9.2`\n- `Microsoft.Identity.Client 4.60.4`\n- `github.com/Azure/azure-sdk-for-go/sdk/azidentity 1.6.0-beta.4.0.20240610221955-50774cd97099`\n- `com.microsoft.azure:msal4j 1.15.1`\n- `Azure.Identity 1.11.4`\n- `Microsoft.Identity.Client 4.61.3`\n\nSource: https://osv.dev/vulnerability/GHSA-m5vv-6r4h-3vj9","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}