LibOSDP RMAC revert to the beginning of the session

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

5.1 · CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

• CVE-2024-52288: 0.13% estimated exploitation activity in the next 30 days; percentile 2.28 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

- Issues: - SCS14 is allowed on encrypted connection (osdpphy.c) - No validation for RMACI is only in response to osdpSCRYPT (osdpcp.c) - Couldn't find anything specific in the OSDP specifications indicating it is forbidden, I'm gussing it shouldn't be allowed according from the secure connection initialization flow (let me know if you think there is spec-rela ted change that should be done) - Attack: - Once RMACI message can be sent during a session, attacker with MITM access to the communication may intercept the original RMACI reply and save it. - While the session continues, the attacker will record all of the replies and save them, till capturing the message to be replied (can be detected by ID, length or time based on inspection of visual activity next to the reade r) - Once attacker captures a session with the message to be replayed, he stops reseting the connection and waits for signal to perform the replay to of the PD to CP message (ex: by signaling remotly to the MIMT…

Published by the source

8 Mar 2024, 17:33 UTC

Last modified by the source

7 Jul 2026, 17:56 UTC

Source last checked

26 Oct 2026, 13:26 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-xhjw-7vh5-qxqm

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-xhjw-7vh5-qxqm

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2024-52288

Advisory: LibOSDP RMAC revert to the beginning of the session
IDs: CVE-2024-52288, GHSA-xhjw-7vh5-qxqm
Record: https://patchnext.com/advisories/cve-2024-52288 (revision 2, source checked 26 Oct 2026, 13:26 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: libosdp 3.0.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI libosdp: affected < 3.0.0; fixed in 3.0.0

## Suggested inspection (read-only)
- `python -m pip show libosdp`: prints the installed version. Run with the environment that serves production active.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on libosdp.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-xhjw-7vh5-qxqm (OSV record GHSA-xhjw-7vh5-qxqm lists affected ranges: PyPI libosdp >=0 <3.0.0 (fixed))
- Verified: https://github.com/advisories/GHSA-xhjw-7vh5-qxqm (GitHub-reviewed advisory GHSA-xhjw-7vh5-qxqm lists affected ranges: PyPI libosdp >=0 <3.0.0)

Commands are suggestions: review each one before running it.