{
  "threat_severity" : "Moderate",
  "public_date" : "2023-09-12T00:00:00Z",
  "bugzilla" : {
    "description" : "glibc: Stack read overflow in getaddrinfo in no-aaaa mode",
    "id" : "2234712",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2234712"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-121",
  "details" : [ "A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.", "A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash." ],
  "statement" : "This issue only affects systems configured with no-aaaa mode via /etc/resolv.conf.\nThe no-aaaa stub resolver option was backported only to Red Hat Enterprise Linux versions 8.7 and 9.1. Therefore, previous versions are not affected.",
  "acknowledgement" : "This issue was discovered by Florian Weimer (Red Hat).",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2023-10-05T00:00:00Z",
    "advisory" : "RHSA-2023:5455",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "glibc-0:2.28-225.el8_8.6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2023-10-05T00:00:00Z",
    "advisory" : "RHSA-2023:5455",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "glibc-0:2.28-225.el8_8.6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-10-05T00:00:00Z",
    "advisory" : "RHSA-2023:5453",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "glibc-0:2.34-60.el9_2.7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-10-05T00:00:00Z",
    "advisory" : "RHSA-2023:5453",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "glibc-0:2.34-60.el9_2.7"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "compat-glibc",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "glibc",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "compat-glibc",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "glibc",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-4527\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-4527" ],
  "name" : "CVE-2023-4527",
  "mitigation" : {
    "value" : "Removing the no-aaaa diagnostic option from /etc/resolv.conf will mitigate this flaw.",
    "lang" : "en:us"
  },
  "csaw" : false
}