CVE-2023-32636
glib: Timeout in fuzz_variant_text
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.
Se encontró una falla en glib, donde el código de deserialización gvariant es vulnerable a una denegación de servicio introducida por una validación de entrada adicional agregada para resolver CVE-2023-29499. La validación de la tabla de desplazamiento puede ser muy lenta. Este error no afecta a ninguna versión publicada de glib, pero sí afecta a los distribuidores de glib que siguieron las instrucciones de los desarrolladores de glib para respaldar la solución inicial para CVE-2023-29499.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2023-05-30 CVE Reserved
- 2023-06-16 CVE Published
- 2024-10-11 CVE Updated
- 2024-10-16 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
- CWE-502: Deserialization of Untrusted Data
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835 | Broken Link | |
| https://security.netapp.com/advisory/ntap-20231110-0002 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://gitlab.gnome.org/GNOME/glib/-/issues/2841 | 2024-01-12 | |
| https://access.redhat.com/security/cve/CVE-2023-32636 | 2024-04-30 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2211833 | 2024-04-30 |