Bug 2211827 (CVE-2023-32665) - CVE-2023-32665 glib: GVariant deserialisation does not match spec for non-normal data
Summary: CVE-2023-32665 glib: GVariant deserialisation does not match spec for non-nor...
Keywords:
Status: NEW
Alias: CVE-2023-32665
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2212688 2212689 2212690 2212691 2212692 2212693 2212694 2212695 2212696 2212697
Blocks: 2160453
TreeView+ depends on / blocked
 
Reported: 2023-06-02 07:13 UTC by Dhananjay Arunesh
Modified: 2024-04-30 11:02 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:6631 0 None None None 2023-11-07 08:22:11 UTC
Red Hat Product Errata RHSA-2024:2528 0 None None None 2024-04-30 11:02:43 UTC

Description Dhananjay Arunesh 2023-06-02 07:13:36 UTC 
GLib's GVariant deserialization prior to GLib 2.74.4 is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.

References:
https://gitlab.gnome.org/GNOME/glib/-/issues/2121
Comment 2 Dhananjay Arunesh 2023-06-06 07:20:19 UTC 
Created glib tracking bugs for this issue:

Affects: epel-all [bug 2212688]


Created glib2 tracking bugs for this issue:

Affects: fedora-37 [bug 2212690]
Affects: fedora-38 [bug 2212696]
Affects: fedora-all [bug 2212689]


Created mingw-glib2 tracking bugs for this issue:

Affects: fedora-37 [bug 2212693]
Affects: fedora-38 [bug 2212697]
Comment 5 errata-xmlrpc 2023-11-07 08:22:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6631 https://access.redhat.com/errata/RHSA-2023:6631
Comment 13 errata-xmlrpc 2024-04-30 11:02:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2528 https://access.redhat.com/errata/RHSA-2024:2528
Note You need to log in before you can comment on or make changes to this bug.