Bug 2333146 (CVE-2024-53580)

Summary:	CVE-2024-53580 iperf: Denial of Service in iperf Due to Improper JSON Handling
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	adudiak, kshier, omaciel, stcannon, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in iperf. This vulnerability allows a Denial of Service (DoS) via the injection of malformed JSON data, which can result in a segmentation fault when a NULL pointer is passed to strdup().	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2333203, 2336075
Bug Blocks:

Description OSIDB Bzimport 2024-12-18 23:01:40 UTC

iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function.

Comment 2 errata-xmlrpc 2025-01-09 10:07:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:0161 https://access.redhat.com/errata/RHSA-2025:0161

Comment 3 errata-xmlrpc 2025-01-09 13:24:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:0168 https://access.redhat.com/errata/RHSA-2025:0168

Comment 4 errata-xmlrpc 2025-01-15 22:35:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:0346 https://access.redhat.com/errata/RHSA-2025:0346

Comment 5 errata-xmlrpc 2025-01-20 01:20:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2025:0403 https://access.redhat.com/errata/RHSA-2025:0403

Comment 6 errata-xmlrpc 2025-01-20 01:31:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2025:0402 https://access.redhat.com/errata/RHSA-2025:0402

Comment 7 errata-xmlrpc 2025-01-20 01:33:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2025:0404 https://access.redhat.com/errata/RHSA-2025:0404

Comment 8 errata-xmlrpc 2025-01-20 21:08:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2025:0440 https://access.redhat.com/errata/RHSA-2025:0440

Comment 9 errata-xmlrpc 2025-01-21 12:29:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:0505 https://access.redhat.com/errata/RHSA-2025:0505

Comment 10 errata-xmlrpc 2025-01-21 19:02:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2025:0548 https://access.redhat.com/errata/RHSA-2025:0548

Comment 11 errata-xmlrpc 2025-01-21 22:48:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:0570 https://access.redhat.com/errata/RHSA-2025:0570