CVE-2024-27837

2024-05-1323:00:53

apple

github.com

downgrade

code-signing

macos sonoma

local attacker

keychain items

AI Score

Confidence

Low

EPSS

Percentile

15.5%

SSVC

Exploitation

None

Automatable

Yes

Technical Impact

Total

JSON

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. A local attacker may gain access to Keychain items.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*"
    ],
    "vendor": "apple",
    "product": "macos",
    "versions": [
      {
        "status": "affected",
        "version": "-",
        "lessThan": "14.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]