Security Tracking Issue

Do not make this issue public.

Impact: Low
Reported Date: 25-Apr-2024
Resolve Bug By: 22-Oct-2024

In case the dates above are already past, please evaluate this bug in your next prioritization review and make a decision then. Remember to explicitly set CLOSED:WONTFIX (in Bugzilla) or Closed:Won't Do (in Jira) if you decide not to fix this bug.

Please review this tracker and its impact on your product or service, as soon as possible. The trackers are filed WITHOUT in-depth analysis as the vulnerability has a Low or Moderate severity impact on this product or service. For more details, please refer to following confluence page - https://docs.engineering.redhat.com/x/3e_3EQ

Please see the Security Errata Policy for further details: https://docs.engineering.redhat.com/x/9kKpDw

Flaw:

CVE-2024-33602 glibc: netgroup cache assumes NSS callback uses in-buffer strings
https://bugzilla.redhat.com/show_bug.cgi?id=2277206

The buffer-resizing code in addgetnetgrentX assumes that all string pointers point into the supplied buffer.

Reference: https://sourceware.org/bugzilla/show_bug.cgi?id=31680