CVE-2023-32665

Published: Sep 14, 2023Modified: Nov 21, 2024

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.

Affected (1)

Products: Gnome: Glib

Gnome

1 product

Glib

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnome Glib	Before 2.74.4

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (12)

https://access.redhat.com/security/cve/CVE-2023-32665

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2211827

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://gitlab.gnome.org/GNOME/glib/-/issues/2121

Source: secalert@redhat.com

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html

Source: secalert@redhat.com

https://security.gentoo.org/glsa/202311-18

Source: secalert@redhat.com

https://security.netapp.com/advisory/ntap-20240426-0006/

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2023-32665