Rocky Linux 9 [CIQ] Security Update: bash / bash-debuginfo / bash-debugsource / bash-devel (crlsa-2023_0340)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230340 advisory. bash: a heap-buffer-overflow in validparametertransform CVE-2022-3715 Tenable has extracted the preceding description block directly from the CIQ security advisory...

Heap Buffer Overflow

bash is vulnerable to a heap buffer overflow. The vulnerability exists in validparametertransform function of subst.c which allows an attacker to crash the system through potentially exploit heap corruption via a malicious HTML page...