Resource management error in pkgconf - CVE-2023-24056

Vulnerability identifier: #VU72137

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-24056

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to variable duplication in libpkgconf/tuple.c:pkgconf_tuple_parse, which may cause unbounded string expansion. A remote attacker can trick the victim to open a specially crafted .pc file containing a few hundred bytes that can expand to one billion bytes, resulting in a denial of service condition.

pkgconf
Business Automation Insights
Amazon Linux AMI
openSUSE Leap
openEuler
IBM Cloud Pak for Security
IBM Cloud Pak for Business Automation
QRadar Suite
pkgconf-help
pkgconf-debuginfo
pkgconf-devel
pkgconf-debugsource
pkgconf
libpkgconf-devel
libpkgconf3
libpkgconf3-debuginfo

Install updates from vendor's website.

pkgconf - update to 1.9.4
IBM Cloud Pak for Security - update to 1.11.3.0
QRadar Suite - update to 1.11.3.0
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF005, 24.0.1-IF004, 25.0.0
Business Automation Insights - update to 24.0.1.0.4
pkgconf-help - update to 1.7.3-2
pkgconf-debuginfo - update to 1.7.3-2
pkgconf-devel - update to 1.7.3-2
pkgconf-debugsource - update to 1.7.3-2
pkgconf - update to 1.7.3-2
pkgconf - update to 1.8.0-4
pkgconf - update to 1.8.0-150400.3.3.1
pkgconf-debuginfo - update to 1.8.0-150400.3.3.1
pkgconf-debugsource - update to 1.8.0-150400.3.3.1
libpkgconf-devel - update to 1.8.0-150400.3.3.1
libpkgconf3 - update to 1.8.0-150400.3.3.1
libpkgconf3-debuginfo - update to 1.8.0-150400.3.3.1

• https://gitea.treehouse.systems/ariadne/pkgconf/commit/628b2b2bafa5d3a2017193ddf375093e70666059
• https://nullprogram.com/blog/2023/01/18/

• Denial of service in pkgconf
• SUSE update for pkgconf
• openEuler update for pkgconf
• Amazon Linux AMI update for pkgconf
• Multiple vulnerabilities in IBM Cloud Pak for Security and IBM QRadar Suite Software
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Business Automation Insights