Lucene search

[email protected]CVE-2023-4527

HistorySep 18, 2023 - 5:15 p.m.

CVE-2023-4527

2023-09-1817:15:55

CWE-121

CWE-125

[email protected]

web.nvd.nist.gov

538

cve-2023-4527

glibc

getaddrinfo

af_unspec

dns

stack disclosure

crash

nvd

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

38.9%

JSON

A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.

Affected configurations

NVD

Node

gnuglibcRange<2.39

Node

redhatcodeready_linux_builder_eusMatch9.2

redhatcodeready_linux_builder_eus_for_power_little_endianMatch9.0_ppc64le

redhatcodeready_linux_builder_eus_for_power_little_endian_eusMatch9.2_ppc64le

redhatcodeready_linux_builder_for_arm64Match9.0_aarch64

redhatcodeready_linux_builder_for_arm64_eusMatch9.2_aarch64

redhatcodeready_linux_builder_for_ibm_z_systemsMatch9.0_s390x

redhatcodeready_linux_builder_for_ibm_z_systems_eusMatch9.2_s390x

redhatenterprise_linuxMatch8.0

redhatenterprise_linuxMatch9.0

redhatenterprise_linux_eusMatch8.8

redhatenterprise_linux_eusMatch9.2

redhatenterprise_linux_for_arm_64Match9.0_aarch64

redhatenterprise_linux_for_arm_64_eusMatch9.2_aarch64

redhatenterprise_linux_for_ibm_z_systemsMatch8.0_s390x

redhatenterprise_linux_for_ibm_z_systems_eusMatch8.8_s390x

redhatenterprise_linux_for_ibm_z_systems_eus_s390xMatch9.2

redhatenterprise_linux_for_ibm_z_systems_s390xMatch9.2

redhatenterprise_linux_for_power_little_endianMatch8.0_ppc64le

redhatenterprise_linux_for_power_little_endianMatch9.2_ppc64le

redhatenterprise_linux_for_power_little_endian_eusMatch8.8_ppc64le

redhatenterprise_linux_for_power_little_endian_eusMatch9.2_ppc64le

redhatenterprise_linux_server_ausMatch9.2

redhatenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsMatch9.2_ppc64le

redhatenterprise_linux_tusMatch8.8

Node

fedoraprojectfedoraMatch37

fedoraprojectfedoraMatch38

fedoraprojectfedoraMatch39

Node

netapph300sMatch-

AND

netapph300s_firmwareMatch-

Node

netapph500sMatch-

AND

netapph500s_firmwareMatch-

Node

netapph700sMatch-

AND

netapph700s_firmwareMatch-

Node

netapph410sMatch-

AND

netapph410s_firmwareMatch-

Node

netapph410cMatch-

AND

netapph410c_firmwareMatch-

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "glibc",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.28-225.el8_8.6",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:enterprise_linux:8::crb",
      "cpe:/a:redhat:enterprise_linux:8::appstream",
      "cpe:/o:redhat:enterprise_linux:8::baseos"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "glibc",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.28-225.el8_8.6",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:enterprise_linux:8::crb",
      "cpe:/a:redhat:enterprise_linux:8::appstream",
      "cpe:/o:redhat:enterprise_linux:8::baseos"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "glibc",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.34-60.el9_2.7",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:enterprise_linux:9::crb",
      "cpe:/o:redhat:enterprise_linux:9::baseos",
      "cpe:/a:redhat:enterprise_linux:9::appstream"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "glibc",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.34-60.el9_2.7",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:enterprise_linux:9::crb",
      "cpe:/o:redhat:enterprise_linux:9::baseos",
      "cpe:/a:redhat:enterprise_linux:9::appstream"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 6",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "compat-glibc",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:6"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 6",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "glibc",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:6"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "compat-glibc",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "glibc",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:7"
    ]
  }
]