Summary
[1:1.42.0-2]
- Backport fix for CVE-2024-24806
Resolves: RHEL-24791
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | libuv | 1:1.42.0-2.el9_4 |
| Oracle Linux · 9 | libuv-devel | 1:1.42.0-2.el9_4 |
Vulnerabilities 1
-
High 7.3
Improper Domain Lookup that potentially leads to SSRF attacks in libuv
libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. Th…