REDHAT-BUG-2399627: High severity Gnome libsoup vulnerability
Out-of-Bounds Read vulnerability in the cookie date handling code of the libsoup HTTP library. The flaw is caused by improper bounds checking in the soupdatetimetostring() function when formatting crafted cookie expiration dates. An attacker can exploit this by sending specially crafted HTTP cookies, potentially leading to unintended memory disclosure. In production builds, the impact is expected to be limited to incorrect output rather than consistent crashes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2399627?
The severity of REDHAT-BUG-2399627 is classified as high due to the potential for exploitation leading to out-of-bounds read vulnerabilities.
How do I fix REDHAT-BUG-2399627?
To fix REDHAT-BUG-2399627, it is recommended to update to the latest version of the libsoup HTTP library where the vulnerability has been patched.
What causes the REDHAT-BUG-2399627 vulnerability?
REDHAT-BUG-2399627 is caused by improper bounds checking in the soup_date_time_to_string() function when handling cookie expiration dates.
What types of attacks can result from REDHAT-BUG-2399627?
An attacker can exploit REDHAT-BUG-2399627 by crafting HTTP cookies with specially formatted expiration dates to trigger the out-of-bounds read.
Which software is affected by REDHAT-BUG-2399627?
REDHAT-BUG-2399627 affects the GNOME libsoup HTTP library.