diff --git a/2023/Advisory-EGI-SVG-2023-55.md b/2023/Advisory-EGI-SVG-2023-55.md new file mode 100644 index 0000000..37b306c --- /dev/null +++ b/2023/Advisory-EGI-SVG-2023-55.md @@ -0,0 +1,87 @@ +--- +title: Advisory-EGI-SVG-2023-55 +permalink: /Advisory-EGI-SVG-2023-55 +redirect_from: + - /Advisory-SVG-CVE-2023-4911 + +published: false +--- + +## Advisory-EGI-SVG-2023-55 + +# 'ADVISORY' [TLP:WHITE] HIGH Risk glibc vulnerability + +Date: 2023-10-06 + +HIGH risk buffer overflow vulnerability in GNU C Library's dynamic loader ld.so +which may lead to privilege escalation. [R 1] [R 2]. This affects RHEL8, RHEL9 +and derivatives, but not RHEL7. + +## IDs AND CVSS SCORE + +EGI SVG ID : EGI-SVG-2023-55 + +CVE ID : CVE-2023-4911 + +CVSS Score : 7.8 [R 1] [R 2] + +## ACTIONS REQUIRED/RECOMMENDED + +Where possible, sites running vulnerable versions should update as soon as +possible. See references below. Note that updating requires a re-boot. + +Sites also have the option of mitigation, see [R 2] + +Sites should be aware that if a public exploit is released which allows easy root +access in the EGI infrastructure this vulnerability is likely to be elevated to +'Critical' and sites will then be required to patch or have mitigation in place +within 7 days or risk suspension. + +## MORE INFORMATION + +Since this does not affect RHEL7 and derivatives, scientific Linux is not affected. + +## STATUS OF THIS ADVISORY + +_TLP:WHITE information - Unlimited distribution_ + +https://advisories.egi.eu/Advisory-EGI-SVG-2023-55 + +https://advisories.egi.eu/Advisory-EGI-SVG-2023-4911 + +Minor updates may be made without re-distribution to the sites. + +## CONTACT AND OTHER INFORMATION ON SVG + +Comments or questions should be sent to + svg-rat at mailman.egi.eu + +Vulnerabilities relevant for EGI can be reported at + report-vulnerability at egi.eu + +(see [R 99] for further details, and other information on SVG) + + +## REFERENCES + +- [R 1] + +- [R 2] + +- [R 3] + +- [R 4] + +- [R 5] + +- [R 6] (RockyLinux) + +- [R 7] (AlmaLinux) + + +- [R 99] + +## CREDITS + +SVG was alerted to this vulnerability by Laurent Caillat-Vallet and separately +by Torsten Harenberg.