More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2222204
https://gitlab.com/redhat/centos-stream/rpms/iperf3/-/merge_requests/5
I see you have created your own bug for CVE-2023-38403. We use internal trackers visible only to Red Hatters for CVEs. For high severity CVEs those do not wait for engineers to ack them, but are prepared by security team. Can you please use CVE identifier to reference a bug? It should be used automatically. Use: Resolves: CVE-2023-38403 In commit message instead of bug number. It would choose appropriate bug number for the release.
Fix in git, moving to MODIFIED. build: https://kojihub.stream.rdu2.redhat.com/koji/buildinfo?buildID=36165 git: https://gitlab.com/redhat/centos-stream/rpms/iperf3/-/commit/44939d1eb3c7fd6dfa87ee0dac8ac8ab7f51161b
This issue is now fixed in the CentOS Stream by this build: https://kojihub.stream.rdu2.redhat.com/koji/buildinfo?buildID=36165 The git commit can be found here: https://gitlab.com/redhat/centos-stream/rpms/iperf3/-/commit/3b2f893b4a102a3834c355ee8d29bb5a6c584073 Feel free to reopen the bug if you feel that this needs more attention.