REDHAT-BUG-2211833: Input Validation
GLib's GVariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-29499
References: https://gitlab.gnome.org/GNOME/glib/-/issues/2841
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2211833?
The severity of REDHAT-BUG-2211833 is classified as low.
What causes the vulnerability in REDHAT-BUG-2211833?
The vulnerability in REDHAT-BUG-2211833 is caused by the additional input validation in GLib's GVariant deserialization code.
Does REDHAT-BUG-2211833 affect released versions of GLib?
No, REDHAT-BUG-2211833 does not affect any released version of GLib.
What impact does REDHAT-BUG-2211833 have on GLib distributors?
REDHAT-BUG-2211833 may cause denial of service issues for GLib distributors due to slow offset table validation.
How can I mitigate the effects of REDHAT-BUG-2211833?
To mitigate the effects of REDHAT-BUG-2211833, users should avoid using the affected deserialization code in critical applications until a fix is provided.