Description
In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo
function would successfully parse a string that contained an IPv4 address
followed by whitespace and arbitrary characters, which could lead
applications to incorrectly assume that it had parsed a valid string,
without the possibility of embedded HTTP headers or other potentially
dangerous substrings.
Notes
| mdeslaur | glibc uses this internally to parse config files, fixing this
may introduce unwanted regressions and changes in behaviour |
| leosilva | See CVE-2019-18348 for Python that is affected by this issue. |
Package
| Upstream: | needs-triage
|
| Ubuntu 18.04 LTS: | DNE
|
| Ubuntu 20.04 LTS: | DNE
|
| Ubuntu 21.10: | DNE
|
| Ubuntu 22.04 LTS: | DNE
|
| Ubuntu 14.04 ESM: | needs-triage
|
Patches:
Updated: 2022-04-25 00:16:52 UTC (commit ecc1009cb19540b950de59270950018900f37f15)