Lucene search

Ubuntu.comUB:CVE-2023-49208

HistoryNov 23, 2023 - 12:00 a.m.

CVE-2023-49208

2023-11-2300:00:00

ubuntu.com

glewlwyd sso server

buffer overflow

fido2 credentials validation

webauthn registration

unix

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

35.7%

JSON

scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer
overflow during FIDO2 credentials validation in webauthn registration.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchglewlwyd< anyUNKNOWN
ubuntu20.04noarchglewlwyd< anyUNKNOWN
ubuntu22.04noarchglewlwyd< anyUNKNOWN
ubuntu23.10noarchglewlwyd< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	glewlwyd	< any	UNKNOWN
ubuntu	20.04	noarch	glewlwyd	< any	UNKNOWN
ubuntu	22.04	noarch	glewlwyd	< any	UNKNOWN
ubuntu	23.10	noarch	glewlwyd	< any	UNKNOWN

References

github.com/babelouest/glewlwyd/commit/f9d8c06aae8dfe17e761b18b577ff169e059e812

github.com/babelouest/glewlwyd/commit/f9d8c06aae8dfe17e761b18b577ff169e059e812 (v2.7.6)

github.com/babelouest/glewlwyd/releases/tag/v2.7.6

launchpad.net/bugs/cve/CVE-2023-49208

nvd.nist.gov/vuln/detail/CVE-2023-49208

security-tracker.debian.org/tracker/CVE-2023-49208

www.cve.org/CVERecord?id=CVE-2023-49208

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

35.7%

JSON

Related for UB:CVE-2023-49208