CVE-2018-19591: Input Validation
In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the ifnametoindex() function.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/glibcto a version that resolves this vulnerability.Fixed in 2.31-13+deb11u11Fixed in 2.31-13+deb11u14Fixed in 2.36-9+deb12u14Fixed in 2.36-9+deb12u7Fixed in 2.41-12+deb13u3Fixed in 2.42-17
Event History
Frequently Asked Questions
What is CVE-2018-19591?
CVE-2018-19591 is a vulnerability in the GNU C Library (glibc) through version 2.28.
How does CVE-2018-19591 work?
CVE-2018-19591 occurs when a crafted hostname is resolved using the getaddrinfo() function, leading to the allocation of a socket descriptor that is not closed.
What is the severity of CVE-2018-19591?
CVE-2018-19591 has a severity rating of 7.5 (high).
Which software is affected by CVE-2018-19591?
GNU glibc versions up to 2.28, Fedoraproject Fedora versions 28 and 29 are affected by CVE-2018-19591.
How can CVE-2018-19591 be fixed?
There are security updates available for GNU glibc and Fedoraproject Fedora to address CVE-2018-19591. Apply the latest patches provided by the respective vendors.