Bug 2369269

Summary:	CVE-2025-23016 FastCGI integer overflow
Product:	[Fedora] Fedora EPEL	Reporter:	David Heitbrink <dheitbrink>
Component:	fcgi	Assignee:	Andrew Bauer <zonexpertconsulting>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	epel9	CC:	ktdreyer, zonexpertconsulting
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	fcgi-2.4.0-52.el10_1 fcgi-2.4.0-52.el9 fcgi-2.4.0-52.el8 fcgi-2.4.0-52.fc42 fcgi-2.4.0-52.fc41	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-06-08 00:30:24 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description David Heitbrink 2025-05-29 21:33:29 UTC

The Issue:
https://www.cve.org/CVERecord?id=CVE-2025-23016

FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.

A fix has been addressed in:

https://github.com/FastCGI-Archives/fcgi2/tree/2.4.6

Comment 1 Fedora Update System 2025-05-30 12:46:04 UTC

FEDORA-2025-e5cc4338e7 (fcgi-2.4.0-52.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-e5cc4338e7

Comment 2 Fedora Update System 2025-05-30 12:46:32 UTC

FEDORA-2025-bf22da3848 (fcgi-2.4.0-52.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-bf22da3848

Comment 3 Fedora Update System 2025-05-30 12:47:07 UTC

FEDORA-EPEL-2025-9c3b16e06c (fcgi-2.4.0-52.el10_1) has been submitted as an update to Fedora EPEL 10.1.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-9c3b16e06c

Comment 4 Fedora Update System 2025-05-30 12:47:51 UTC

FEDORA-EPEL-2025-70ce865582 (fcgi-2.4.0-52.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-70ce865582

Comment 5 Fedora Update System 2025-05-30 12:49:14 UTC

FEDORA-EPEL-2025-e655c1f968 (fcgi-2.4.0-52.el8) has been submitted as an update to Fedora EPEL 8.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-e655c1f968

Comment 6 Fedora Update System 2025-05-31 00:53:27 UTC

FEDORA-2025-bf22da3848 has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-bf22da3848`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-bf22da3848

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2025-05-31 01:41:19 UTC

FEDORA-EPEL-2025-9c3b16e06c has been pushed to the Fedora EPEL 10.1 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-9c3b16e06c

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2025-05-31 01:47:56 UTC

FEDORA-EPEL-2025-70ce865582 has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-70ce865582

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2025-05-31 01:53:54 UTC

FEDORA-EPEL-2025-e655c1f968 has been pushed to the Fedora EPEL 8 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-e655c1f968

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 10 Fedora Update System 2025-05-31 02:28:44 UTC

FEDORA-2025-e5cc4338e7 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-e5cc4338e7`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-e5cc4338e7

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 11 Fedora Update System 2025-06-08 00:30:24 UTC

FEDORA-EPEL-2025-9c3b16e06c (fcgi-2.4.0-52.el10_1) has been pushed to the Fedora EPEL 10.1 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 12 Fedora Update System 2025-06-08 00:55:14 UTC

FEDORA-EPEL-2025-70ce865582 (fcgi-2.4.0-52.el9) has been pushed to the Fedora EPEL 9 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 13 Fedora Update System 2025-06-08 01:13:27 UTC

FEDORA-EPEL-2025-e655c1f968 (fcgi-2.4.0-52.el8) has been pushed to the Fedora EPEL 8 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 14 Fedora Update System 2025-06-08 01:31:46 UTC

FEDORA-2025-e5cc4338e7 (fcgi-2.4.0-52.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 15 Fedora Update System 2025-06-08 02:31:28 UTC

FEDORA-2025-bf22da3848 (fcgi-2.4.0-52.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.