CVE-2023-24056 Denial of service in n/a
An attacker can cause a denial of service in pkgconf by providing a malicious .pc file that triggers unbounded string expansion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-24056?
CVE-2023-24056 is a medium-severity denial of service vulnerability in n/a, published on 22 Jan 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.
Weakness: CWE-787
Which versions are affected by CVE-2023-24056?
It affects 1 product.
Linux distribution packages (3)
pkgconf SUSE:Package Hub 15 SP3 | All versions | 1.5.3-bp153.2.3.1 |
pkgconf openSUSE:Leap 15.3 | All versions | 1.5.3-bp153.2.3.1 |
pkgconf openSUSE:Leap 15.4 | All versions | 1.8.0-150400.3.3.1 |
Products include Pkgconf Pkgconf.
How do I fix CVE-2023-24056?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-24056 being exploited?
There is no known exploitation of CVE-2023-24056 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as ALPINE-CVE-2023-24056, AZL-13124, CLEANSTART-2024-KI01619, DEBIAN-CVE-2023-24056, GHSA-6rfm-3v66-6wr2, MGASA-2023-0077 and 5 more.