CVE-2023-39976 - Vulnerability Details - OpenCVE

ReportizFlow

log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Clusterlabs	Libqb
Redhat	Enterprise Linux Rhel Eus

Configuration 1 [-]

cpe:2.3:a:clusterlabs:libqb:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 9
libqb-0:2.0.6-4.el9_3	cpe:/a:redhat:enterprise_linux:9	RHSA-2023:6578	2023-11-07T00:00:00Z
Red Hat Enterprise Linux 9.0 Extended Update Support
libqb-0:2.0.3-12.el9_0	cpe:/a:redhat:rhel_eus:9.0	RHSA-2023:5597	2023-10-10T00:00:00Z
Red Hat Enterprise Linux 9.2 Extended Update Support
libqb-0:2.0.6-3.el9_2	cpe:/a:redhat:rhel_eus:9.2	RHSA-2023:7376	2023-11-21T00:00:00Z

References

Link	Providers
https://github.com/ClusterLabs/libqb/commit/1bbaa929b77113532785c408dd1b41cd0521ffc8
https://github.com/ClusterLabs/libqb/compare/v2.0.7...v2.0.8
https://github.com/ClusterLabs/libqb/pull/490
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KECNF7LFBPE57XSBT6EM7ACVMIBP63WH/
https://nvd.nist.gov/vuln/detail/CVE-2023-39976
https://www.cve.org/CVERecord?id=CVE-2023-39976

History

Tue, 15 Oct 2024 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-08-08T00:00:00

Updated: 2024-10-15T17:56:46.579Z

Reserved: 2023-08-08T00:00:00

Link: CVE-2023-39976

Vulnrichment

Updated: 2024-08-02T18:18:10.207Z

NVD

Status : Modified

Published: 2023-08-08T06:15:46.590

Modified: 2024-11-21T08:16:09.810

Link: CVE-2023-39976

Redhat

Severity : Moderate

Publid Date: 2023-08-08T00:00:00Z

Links: CVE-2023-39976 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-39976", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-10-15T17:56:46.579Z", "dateReserved": "2023-08-08T00:00:00", "datePublished": "2023-08-08T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-08-24T02:06:20.795464"}, "descriptions": [{"lang": "en", "value": "log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/ClusterLabs/libqb/pull/490"}, {"url": "https://github.com/ClusterLabs/libqb/commit/1bbaa929b77113532785c408dd1b41cd0521ffc8"}, {"url": "https://github.com/ClusterLabs/libqb/compare/v2.0.7...v2.0.8"}, {"name": "FEDORA-2023-5a717dd33d", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KECNF7LFBPE57XSBT6EM7ACVMIBP63WH/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:18:10.207Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/ClusterLabs/libqb/pull/490", "tags": ["x_transferred"]}, {"url": "https://github.com/ClusterLabs/libqb/commit/1bbaa929b77113532785c408dd1b41cd0521ffc8", "tags": ["x_transferred"]}, {"url": "https://github.com/ClusterLabs/libqb/compare/v2.0.7...v2.0.8", "tags": ["x_transferred"]}, {"name": "FEDORA-2023-5a717dd33d", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KECNF7LFBPE57XSBT6EM7ACVMIBP63WH/"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-15T17:56:38.433214Z", "id": "CVE-2023-39976", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T17:56:46.579Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/ClusterLabs/libqb/pull/490", "tags": ["x_transferred"]}, {"url": "https://github.com/ClusterLabs/libqb/commit/1bbaa929b77113532785c408dd1b41cd0521ffc8", "tags": ["x_transferred"]}, {"url": "https://github.com/ClusterLabs/libqb/compare/v2.0.7...v2.0.8", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KECNF7LFBPE57XSBT6EM7ACVMIBP63WH/", "name": "FEDORA-2023-5a717dd33d", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:18:10.207Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-39976", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-15T17:56:38.433214Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T17:56:42.713Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/ClusterLabs/libqb/pull/490"}, {"url": "https://github.com/ClusterLabs/libqb/commit/1bbaa929b77113532785c408dd1b41cd0521ffc8"}, {"url": "https://github.com/ClusterLabs/libqb/compare/v2.0.7...v2.0.8"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KECNF7LFBPE57XSBT6EM7ACVMIBP63WH/", "name": "FEDORA-2023-5a717dd33d", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-08-24T02:06:20.795464"}}}, "cveMetadata": {"cveId": "CVE-2023-39976", "state": "PUBLISHED", "dateUpdated": "2024-10-15T17:56:46.579Z", "dateReserved": "2023-08-08T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2023-08-08T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:clusterlabs:libqb:*:*:*:*:*:*:*:*", "matchCriteriaId": "6356D585-67AB-4E61-9DCB-50DD9662CED3", "versionEndExcluding": "2.0.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered."}], "id": "CVE-2023-39976", "lastModified": "2024-11-21T08:16:09.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-08-08T06:15:46.590", "references": [{"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/ClusterLabs/libqb/commit/1bbaa929b77113532785c408dd1b41cd0521ffc8"}, {"source": "[email protected]", "tags": ["Not Applicable"], "url": "https://github.com/ClusterLabs/libqb/compare/v2.0.7...v2.0.8"}, {"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/ClusterLabs/libqb/pull/490"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KECNF7LFBPE57XSBT6EM7ACVMIBP63WH/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/ClusterLabs/libqb/commit/1bbaa929b77113532785c408dd1b41cd0521ffc8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Not Applicable"], "url": "https://github.com/ClusterLabs/libqb/compare/v2.0.7...v2.0.8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/ClusterLabs/libqb/pull/490"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KECNF7LFBPE57XSBT6EM7ACVMIBP63WH/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "[email protected]", "type": "Primary"}]}