Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

update: glib #1586

Open
dongsupark opened this issue Nov 26, 2024 · 1 comment
Open

update: glib #1586

dongsupark opened this issue Nov 26, 2024 · 1 comment
Labels
advisory security advisory cvss/CRITICAL >= 9 assessed CVSS security security concerns

Comments

@dongsupark
Copy link
Member

dongsupark commented Nov 26, 2024 •
edited
Loading

Name: glib
CVEs: CVE-2024-52533
CVSSs: 9.8
Action Needed: update to >= 2.82.1

Summary: gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.

See also https://seclists.org/oss-sec/2024/q4/90, https://bugzilla.redhat.com/show_bug.cgi?id=2325340.

refmap.gentoo: TBD
@dongsupark dongsupark added security security concerns advisory security advisory labels Nov 26, 2024
@dongsupark dongsupark moved this from 📝 Needs Triage to 🪵Backlog in Flatcar tactical, release planning, and roadmap Nov 26, 2024
@dongsupark dongsupark added the cvss/CRITICAL >= 9 assessed CVSS label Dec 17, 2024
@dongsupark
Copy link
Member Author

Set to cvss/CRITICAL according to https://www.cve.org/CVERecord/?id=CVE-2024-52533.
However, that might not be true, as most other distros seem to set it to medium.

@github-actions github-actions bot mentioned this issue Dec 22, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
advisory security advisory cvss/CRITICAL >= 9 assessed CVSS security security concerns
Projects
Flatcar tactical, release planning, and roadmap
Status: 🪵Backlog
Milestone
No milestone
Development

No branches or pull requests
1 participant
@dongsupark