Bug 32328 - glibc new DoS security issue due to memory leak in getaddrinfo.c, CVE-2023-5156
Summary: glibc new DoS security issue due to memory leak in getaddrinfo.c, CVE-2023-5156
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: https://nvd.nist.gov/vuln/detail/CVE-...
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2023-09-27 11:38 CEST by Marja Van Waes
Modified: 2023-10-03 12:56 CEST (History)
4 users (show)

See Also:
Source RPM: glibc-2.36-49.mga9.src.rpm
CVE: 2023-5156
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Marja Van Waes 2023-09-27 11:38:10 CEST 
A new glibc security issue was introduced by the fix for CVE-2023-4806.

The affected glibc package for Mageia 9 has (at this moment) not yet been moved from testing to core/updates, but is ready to be moved
Marja Van Waes 2023-09-27 11:38:28 CEST

Whiteboard: (none) => MGA9TOO

Comment 1 Nicolas Salguero 2023-09-28 11:15:51 CEST 
Hi,

Actually, the glibc package has been moved to core/updates.

glibc-2.36-50.mga{9|10} are currently building and they contain the patch for that new CVE.

Best regards,

Nico.

CC: (none) => nicolas.salguero
Status: NEW => ASSIGNED
Assignee: basesystem => nicolas.salguero

Comment 2 Nicolas Salguero 2023-09-29 09:46:19 CEST 
Suggested advisory:
========================

The updated packages fix a security vulnerability:

A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash. (CVE-2023-5156)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5156
========================

Updated packages in core/updates_testing:
========================
glibc-2.36-50.mga9
glibc-devel-2.36-50.mga9
glibc-doc-2.36-50.mga9
glibc-i18ndata-2.36-50.mga9
glibc-profile-2.36-50.mga9
glibc-static-devel-2.36-50.mga9
glibc-utils-2.36-50.mga9
nscd-2.36-50.mga9

from SRPM:
glibc-2.36-50.mga9.src.rpm

Version: Cauldron => 9
Source RPM: glibc-2.36-49.mga9, glibc-2.36-49.mga10 => glibc-2.36-49.mga9.src.rpm
Whiteboard: MGA9TOO => (none)
Assignee: nicolas.salguero => qa-bugs

Comment 3 Morgan Leijström 2023-09-30 09:42:03 CEST 
mga9-64 no regressions noted.
Normal dekstop activities
Plasma, Intel I7-870

CC: (none) => fri

Comment 4 Thomas Andrews 2023-10-03 02:08:55 CEST 
Have used this for a couple of days now, with no regressions noticed.

Giving it an OK and Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs
Whiteboard: (none) => MGA9-64-OK

Marja Van Waes 2023-10-03 10:10:22 CEST

Keywords: (none) => advisory

Comment 5 Mageia Robot 2023-10-03 12:56:25 CEST 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2023-0281.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.