Bug 2210466 (CVE-2023-2879)

Summary:	CVE-2023-2879 wireshark: infinite loop in GDSDB dissector
Product:	[Other] Security Response	Reporter:	Nick Tait <ntait>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fhrdina, mruprich
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in wireshark. This issue occurs in the GDSDB dissector, and could go into an infinite loop. It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-29 18:33:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2210648, 2210649, 2210650
Bug Blocks:	2210468

Description Nick Tait 2023-05-27 18:01:50 UTC

GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file

https://gitlab.com/wireshark/wireshark/-/issues/19068
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2879.json
https://www.wireshark.org/security/wnpa-sec-2023-14.html

Comment 2 Sandipan Roy 2023-05-29 04:30:59 UTC

Created wireshark tracking bugs for this issue:

Affects: fedora-all [bug 2210648]

Comment 4 Product Security DevOps Team 2023-05-29 18:33:21 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-2879