CVE-2023-4527
CVE-2023-4527: 2 tracked advisory records across NetApp, Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
NetApp
1 advisory- Advisory severityMedium6.5
Medium [CVE-2023-4527] GNU C Library (glibc) Vulnerability in NetApp Products
NTAP-20231116-0012Source published Source updated
Multiple NetApp products incorporate GNU C. GNU C Library (glibc) versions prior to 2.39 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information or Denial of Service (DoS). Affected products: NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S, NetApp HCI Baseboard Management Controller (BMC) - H410C, NetApp HCI Compute Node (Bootstrap OS). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
- Affected products in this advisory
- NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S
- NetApp HCI Baseboard Management Controller (BMC) - H410C
- NetApp HCI Compute Node (Bootstrap OS)
- Source-reported affected versions
- 2.39
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S has no planned fix; migrate to a supported release or product and consult NetApp's end-of-support notice.
- NetApp HCI Baseboard Management Controller (BMC) - H410C has no planned fix; migrate to a supported release or product and consult NetApp's end-of-support notice.
- NetApp HCI Compute Node (Bootstrap OS) has no planned fix; migrate to a supported release or product and consult NetApp's end-of-support notice.
Red Hat
1 advisory- Advisory severityMedium6.5
Medium [CVE-2023-4527] stack read overflow in getaddrinfo in no-aaaa mode
CVE-2023-4527Source published Source updated
A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash. The no-aaaa stub resolver option was backported only to Red Hat Enterprise Linux versions 8.7 and 9.1. Therefore, previous versions are not affected. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H). Weakness: CWE-121. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2023:5455, RHSA-2023:5453. Affected products named by the advisory: Red Hat package: glibc.
- Affected products in this advisory
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat package: glibc
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- glibc-0:2.28-225.el8_8.6
- glibc-0:2.34-60.el9_2.7
- RHSA-2023:5455
- RHSA-2023:5453
- Mitigation guidance
- Removing the no-aaaa diagnostic option from /etc/resolv.conf will mitigate this flaw.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.