CVE-2024-31995
zcap has incomplete expiration checks in capability chains.
Description
### Impact When invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the `expires` property is not properly checked against the current date or other `date` param. This can allow invocations outside of the original intended time period. A zcap still cannot be invoked without being able to use the associated private key material. ### Patches `@digitalbazaar/zcap` v9.0.1 fixes expiration checking. ### Workarounds A zcap could be revoked at any time. ### References https://github.com/digitalbazaar/zcap/pull/82
How to fix CVE-2024-31995
To remediate CVE-2024-31995, upgrade the affected package to a fixed version below.
- —upgrade to 9.0.1 or later
Is CVE-2024-31995 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 9.0.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |