In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
| Link | Tags |
|---|---|
| https://sourceware.org/bugzilla/show_bug.cgi?id=20018 | issue tracking third party advisory patch |
| http://www.securityfocus.com/bid/106672 | vdb entry third party advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=1347549 | issue tracking third party advisory |
| http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00082.html | mailing list third party advisory vendor advisory |
| https://access.redhat.com/errata/RHSA-2019:2118 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2019:3513 | vendor advisory |