CVE-2023-32636CWE-400CWE-502denial-of-serviceinsecure-deserialization

CVE-2023-32636

Medium · published September 15, 2023

CVSS v3.1
4.7
EPSS
1%
Percentile
55.8
In the wild
Unconfirmed
What it is

A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00791 · 55.8th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-502 · Deserialization of Untrusted Data
Published
2023-09-15T00:15Z
Affected products (1)
ProductVersionsFixed in
gnome/glib< 2.74.42.74.4
References (7)
https://gitlab.gnome.org/GNOME/glib/-/issues/2841 · [email protected]https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835 · [email protected]https://security.netapp.com/advisory/ntap-20231110-0002/ · [email protected]https://gitlab.gnome.org/GNOME/glib/-/issues/2841 · af854a3a-2127-422b-91ae-364da2661108https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20231110-0002/ · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 14 SEP 19:19Z
    A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to…
    cvelistv5