Threats affecting pkg:brew/icloudpd

A command injection vulnerability (CVE-2024-34062) exists in the tqdm Python package used by icloudpd. The flaw arises because certain non-boolean CLI arguments are unsafely passed to Python's eval function, allowing arbitrary code execution. This affects icloudpd versions from 1.17.3 up to but not including 1.21.0. A fix is available in tqdm version 4.66.3. No workarounds are available.

CVE-2024-49769 is a denial-of-service vulnerability in the waitress server used by icloudpd. When a remote client closes the connection prematurely, waitress fails to clean up the socket properly, causing the main thread to enter a busy loop attempting to write to a non-existent socket. This leads to high CPU usage and resource exhaustion. The issue affects icloudpd versions from 1.21.0 up to but not including 1.25.1. Waitress 3.0.1 includes a fix that resolves this race condition. No workarounds are available.

Pure-python WSGI server Security Fix(es): * python-waitress: request processing race condition in HTTP pipelining with invalid first request (CVE-2024-49768) * Waitress has a denial of service leading to high CPU usage/resource exhaustion (CVE-2024-49769) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.