CVE-2023-49208

2023-11-2318:15:07

Debian Security Bug Tracker

security-tracker.debian.org

glewlwyd sso server

buffer overflow

cve-2023-49208

fido2 credentials validation

webauthn registration

unix

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

35.7%

JSON

scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registration.

OSVersionArchitecturePackageVersionFilename
Debian12allglewlwyd< 2.7.5-3+deb12u1glewlwyd_2.7.5-3+deb12u1_all.deb
Debian11allglewlwyd<= 2.5.2-2+deb11u2glewlwyd_2.5.2-2+deb11u2_all.deb
Debian999allglewlwyd< 2.7.6+ds-1glewlwyd_2.7.6+ds-1_all.deb
Debian13allglewlwyd< 2.7.6+ds-1glewlwyd_2.7.6+ds-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	glewlwyd	< 2.7.5-3+deb12u1	glewlwyd_2.7.5-3+deb12u1_all.deb
Debian	11	all	glewlwyd	<= 2.5.2-2+deb11u2	glewlwyd_2.5.2-2+deb11u2_all.deb
Debian	999	all	glewlwyd	< 2.7.6+ds-1	glewlwyd_2.7.6+ds-1_all.deb
Debian	13	all	glewlwyd	< 2.7.6+ds-1	glewlwyd_2.7.6+ds-1_all.deb