CVE-2023-4527: Fedoraproject Fedora

Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days.

A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.

Affected products

  • Fedoraproject Fedora: version 37 only; version 38 only; version 39 only
  • GNU Glibc: from 2.36, before 2.36.113 (fixed in 2.36.113); from 2.37, before 2.37.38 (fixed in 2.37.38); from 2.38, before 2.38.19 (fixed in 2.38.19)
  • Netapp h300s Firmware: affected versions not specified
  • Netapp h410c Firmware: affected versions not specified
  • Netapp h410s Firmware: affected versions not specified
  • Netapp h500s Firmware: affected versions not specified
  • Netapp h700s Firmware: affected versions not specified
  • Red Hat Codeready Linux Builder Eus: version 9.2 only
  • Red Hat Codeready Linux Builder Eus For Power Little Endian: version 9.0_ppc64le only
  • Red Hat Codeready Linux Builder Eus For Power Little Endian Eus: version 9.2_ppc64le only
  • Red Hat Codeready Linux Builder For ARM64: version 9.0_aarch64 only
  • Red Hat Codeready Linux Builder For ARM64 Eus: version 9.2_aarch64 only
  • Red Hat Codeready Linux Builder For IBM Z Systems: version 9.0_s390x only
  • Red Hat Codeready Linux Builder For IBM Z Systems Eus: version 9.2_s390x only
  • Red Hat Enterprise Linux: version 8.0 only; version 9.0 only
  • Red Hat Enterprise Linux Eus: version 8.8 only; version 9.2 only
  • Red Hat Enterprise Linux For Arm 64: version 9.0_aarch64 only
  • Red Hat Enterprise Linux For Arm 64 Eus: version 9.2_aarch64 only
  • Red Hat Enterprise Linux For IBM Z Systems: version 8.0_s390x only
  • Red Hat Enterprise Linux For IBM Z Systems Eus: version 8.8_s390x only
  • Red Hat Enterprise Linux For IBM Z Systems Eus s390x: version 9.2 only
  • Red Hat Enterprise Linux For IBM Z Systems s390x: version 9.2 only
  • Red Hat Enterprise Linux For Power Little Endian: version 8.0_ppc64le only; version 9.2_ppc64le only
  • Red Hat Enterprise Linux For Power Little Endian Eus: version 8.8_ppc64le only; version 9.2_ppc64le only
  • Red Hat Enterprise Linux Server Aus: version 9.2 only
  • and 2 more

Published 2023-09-18. Last modified 2026-06-17.