CVE-2023-32636

A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gitlab.gnome.org/GNOME/glib/-/issues/2841	Issue Tracking Vendor Advisory
https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835	Broken Link
https://security.netapp.com/advisory/ntap-20231110-0002/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:*

History

12 Jan 2024, 22:09

Type	Values Removed	Values Added
CWE		CWE-502
References	~~() https://security.netapp.com/advisory/ntap-20231110-0002/ -~~	() https://security.netapp.com/advisory/ntap-20231110-0002/ - Third Party Advisory

10 Nov 2023, 18:15

Type	Values Removed	Values Added
References		() https://security.netapp.com/advisory/ntap-20231110-0002/ -

19 Sep 2023, 18:59

Type	Values Removed	Values Added
References	~~(MISC) https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835 -~~	(MISC) https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835 - Broken Link
References	~~(MISC) https://gitlab.gnome.org/GNOME/glib/-/issues/2841 -~~	(MISC) https://gitlab.gnome.org/GNOME/glib/-/issues/2841 - Issue Tracking, Vendor Advisory
First Time		Gnome glib Gnome
CPE		cpe:2.3:a:gnome:glib::::::::
CWE		CWE-400
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

15 Sep 2023, 00:31

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-09-14 20:15

Updated : 2024-01-12 22:09

NVD link : CVE-2023-32636

Mitre link : CVE-2023-32636

CVE.ORG link : CVE-2023-32636

JSON object : View

Products Affected

gnome

glib

CWE

CWE-502

Deserialization of Untrusted Data

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2023-32636", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "published": "2023-09-14T20:15:09.653", "references": [{"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/2841", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835", "tags": ["Broken Link"], "source": "secalert@redhat.com"}, {"url": "https://security.netapp.com/advisory/ntap-20231110-0002/", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en glib, donde el c\u00f3digo de deserializaci\u00f3n gvariant es vulnerable a una denegaci\u00f3n de servicio introducida por una validaci\u00f3n de entrada adicional agregada para resolver CVE-2023-29499. La validaci\u00f3n de la tabla de desplazamiento puede ser muy lenta. Este error no afecta a ninguna versi\u00f3n publicada de glib, pero s\u00ed afecta a los distribuidores de glib que siguieron las instrucciones de los desarrolladores de glib para respaldar la soluci\u00f3n inicial para CVE-2023-29499."}], "lastModified": "2024-01-12T22:09:56.247", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DF67CEA-BB12-4E90-9788-1AD9EF0FCB38", "versionEndExcluding": "2.74.4"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}