Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-m5wq-r4r4-4qrh

Опубликовано: 20 мар. 2026
Источник: github
Github: Не прошло ревью
CVSS3: 7.5

Описание

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.

EPSS

Процентиль: 17%
0.00052
Низкий

7.5 High

CVSS3

Дефекты

CWE-125

Связанные уязвимости

CVSS3: 7.5
ubuntu
20 дней назад

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.

CVSS3: 6.5
redhat
20 дней назад

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.

CVSS3: 7.5
nvd
20 дней назад

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.

CVSS3: 5.9
msrc
19 дней назад

gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response

CVSS3: 7.5
debian
20 дней назад

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.co ...

EPSS

Процентиль: 17%
0.00052
Низкий

7.5 High

CVSS3

Дефекты

CWE-125