Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-32665: GLib's GVariant deserialization prior to GLib 2.74.4 is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service. CVE-2023-32611: GLib's GVariant deserialization prior to GLib 2.74.4 is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service. CVE-2023-29499: GLib's GVariant deserialization prior to GLib 2.74.4 failed to validate the input conforms to the expected format, leading to denial of service. CVE-2023-25180: The upstream bug report describes this issue as follows: A vulnerability was found in GLib2.0, where DoS caused by handling a malicious text-form variant which is structured to cause looping superlinear to its text size. Applications are at risk if they parse untrusted text-form variants. CVE-2023-24593: The upstream bug report describes this issue as follows: A vulnerability was found in GLib2.0, where DoS caused by handling a malicious text-form variant which is structured to cause looping superlinear to its text size. Applications are at risk if they parse untrusted text-form variants.
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | glib2 | 0:2.74.7-688.amzn2023.0.1 |
| Amazon Linux · 2023 | glib2-debuginfo | 0:2.74.7-688.amzn2023.0.1 |
| Amazon Linux · 2023 | glib2-debugsource | 0:2.74.7-688.amzn2023.0.1 |
| Amazon Linux · 2023 | glib2-devel | 0:2.74.7-688.amzn2023.0.1 |
| Amazon Linux · 2023 | glib2-devel-debuginfo | 0:2.74.7-688.amzn2023.0.1 |
| Amazon Linux · 2023 | glib2-doc | 0:2.74.7-688.amzn2023.0.1 |
| Amazon Linux · 2023 | glib2-static | 0:2.74.7-688.amzn2023.0.1 |
| Amazon Linux · 2023 | glib2-tests | 0:2.74.7-688.amzn2023.0.1 |
| Amazon Linux · 2023 | glib2-tests-debuginfo | 0:2.74.7-688.amzn2023.0.1 |
Vulnerabilities 5
-
Medium 5.5
Gvariant offset table entry size is not checked in is_normal()
A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.
-
Medium 5.5
G_variant_byteswap() can take a long time with some non-normal inputs
A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.
-
Medium 5.5
Gvariant deserialisation does not match spec for non-normal data
A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.
-
Unscored —
-
Unscored —
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-24593.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-25180.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-29499.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-32611.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-32665.html