Out-of-bounds read in GNU C Library (glibc) - CVE-2019-9169

Vulnerability identifier: #VU17859

CSH Severity: Medium

CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-9169

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack or gain access to sensitive information.

The vulnerability exists due to heap-based buffer over-read via an attempted case-insensitive regular-expression match. A remote attacker can perform a denial of service attack or gain access to sensitive information.

GNU C Library (glibc)
Gentoo Linux
Arch Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Ubuntu
Brocade Fabric OS
Red Hat OpenShift Serverless
Windows Container Support for Red Hat OpenShift
OpenShift Virtualization
Service Telemetry Framework
Netcool Operations Insight
IBM Cloud Transformation Advisor
Cloud Pak for Security (CP4S)
Red Hat OpenShift Jaeger
IBM Security Verify Access
Web Terminal
libc6 (Ubuntu package)
glibc (Red Hat package)
Watson Studio on Cloud Pak for Data

The vulnerability is fixed in GIT repository.

GNU C Library (glibc) - update to 2.30
Red Hat OpenShift Serverless - update to 1.16.0
Cloud Pak for Security (CP4S) - update to 1.8.0.0
Red Hat OpenShift Jaeger - addressed in versions 1.17.9, 1.20.4
Windows Container Support for Red Hat OpenShift - update to 2.0.1
Web Terminal - update to 1.3
Netcool Operations Insight - update to 1.6.8
OpenShift Virtualization - addressed in versions 2.6.6, 4.8.0
libc6 (Ubuntu package) - addressed in versions 2.23-0ubuntu11.2, 2.27-3ubuntu1.2, 2.30-0ubuntu2.2
glibc (Red Hat package) - update to 2.28-151.el8
IBM Cloud Transformation Advisor - update to 3.10.0
Watson Studio on Cloud Pak for Data - addressed in versions 4.8.7, 5.1.0
Brocade Fabric OS - addressed in versions 8.2.0 CBN5, 8.2.3c

• https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140
• https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142
• https://sourceware.org/bugzilla/show_bug.cgi?id=24114
• https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=583dd860d5b833037175247230a328f0050dbfe9

• Denial of service in GNU C Library (glibc)
• Arch Linux update for glibc
• Gentoo update for glibc
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in Windows Container Support for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in OpenShift Serverless
• Multiple vulnerabilities in Red Hat Web Terminal
• Multiple vulnerabilities in IBM Security Verify Access
• Multiple vulnerabilities in Red Hat Service Telemetry Framework
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Brocade Fabric OS update for GNU C Library
• Red Hat Enterprise Linux 8 update for glibc
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Multiple vulnerabilities in OpenShift Virtualization 2.6
• Multiple vulnerabilities in IBM Watson Studio on Cloud Pak for Data
• Ubuntu update for glibc