CVE-2018-19591CWE-20CWE-404

CVE-2018-19591

High · published December 4, 2018

CVSS v3.1
7.5
EPSS
6%
Percentile
92.8
In the wild
Unconfirmed
What it is

In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.05532 · 92.8th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-404 · Improper Resource Shutdown or Release
Published
2018-12-04T21:29Z
Affected products (3)
ProductVersionsFixed in
gnu/glibc≤ 2.28—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
References (23)
http://www.securityfocus.com/bid/106037 · [email protected]http://www.securitytracker.com/id/1042174 · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BO7WHN52GFMC5F2I2232GFIPSSXWFV7G/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M52KE4YR3GNMHQUOS3DKAGZD5TQ5D5UH/ · [email protected]https://security.gentoo.org/glsa/201903-09 · [email protected]https://security.gentoo.org/glsa/201908-06 · [email protected]https://security.netapp.com/advisory/ntap-20190321-0003/ · [email protected]https://sourceware.org/bugzilla/show_bug.cgi?id=23927 · [email protected]https://sourceware.org/git/?p=glibc.git%3Ba=blob_plain%3Bf=NEWS%3Bhb=HEAD · [email protected]https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commitdiff%3Bh=d527c860f5a3f0ed687bd03f0cb464612dc23408 · [email protected]https://usn.ubuntu.com/4416-1/ · [email protected]http://www.securityfocus.com/bid/106037 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1042174 · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BO7WHN52GFMC5F2I2232GFIPSSXWFV7G/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M52KE4YR3GNMHQUOS3DKAGZD5TQ5D5UH/ · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201903-09 · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201908-06 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20190321-0003/ · af854a3a-2127-422b-91ae-364da2661108https://sourceware.org/bugzilla/show_bug.cgi?id=23927 · af854a3a-2127-422b-91ae-364da2661108https://sourceware.org/git/?p=glibc.git%3Ba=blob_plain%3Bf=NEWS%3Bhb=HEAD · af854a3a-2127-422b-91ae-364da2661108https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commitdiff%3Bh=d527c860f5a3f0ed687bd03f0cb464612dc23408 · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4416-1/ · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 04 DEC 16:00Z
    In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket…
    cvelistv5