{"id":"CVE-2023-32665","state":"PUBLISHED","title":"Gvariant deserialisation does not match spec for non-normal data","description":"A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.","publishedAt":"2023-09-14T19:03:58.229Z","updatedAt":"2026-10-14T23:17:13.566Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["n/a glib2","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9","Fedora Fedora 38","Fedora Extra Packages for Enterprise Linux","Fedora Fedora","Fedora Fedora 37"],"affected":[{"vendor":"n/a","product":"glib2","defaultStatus":"affected"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"glib2","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"glib2","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"glib2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"glib2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Fedora","product":"Fedora 38","packageName":"glib2","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Extra Packages for Enterprise Linux","packageName":"glib","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora","packageName":"glib2","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 37","packageName":"glib2","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 38","packageName":"mingw-glib2","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 37","packageName":"mingw-glib2","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"}],"references":["https://access.redhat.com/security/cve/CVE-2023-32665","https://bugzilla.redhat.com/show_bug.cgi?id=2211827","https://gitlab.gnome.org/GNOME/glib/-/issues/2121","https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html","https://security.gentoo.org/glsa/202311-18","https://security.netapp.com/advisory/ntap-20240426-0006/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"weaknesses":["CWE-400"],"ingestedAt":"2026-10-29T20:06:00.499Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/32xxx/CVE-2023-32665.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-32665","state":"PUBLISHED","datePublished":"2023-09-14T19:03:58.229Z","dateUpdated":"2026-10-14T23:17:13.566Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-05-30T11:48:42.074Z"},"containers":{"cna":{"title":"Gvariant deserialisation does not match spec for non-normal data","descriptions":[{"lang":"en","value":"A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service."}],"affected":[{"vendor":"n/a","product":"glib2","defaultStatus":"affected"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"glib2","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"glib2","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"glib2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"glib2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Fedora","product":"Fedora 38","packageName":"glib2","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Extra Packages for Enterprise Linux","packageName":"glib","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora","packageName":"glib2","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 37","packageName":"glib2","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 38","packageName":"mingw-glib2","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 37","packageName":"mingw-glib2","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-32665","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211827","name":"RHBZ#2211827","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://gitlab.gnome.org/GNOME/glib/-/issues/2121"},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html"},{"url":"https://security.gentoo.org/glsa/202311-18"},{"url":"https://security.netapp.com/advisory/ntap-20240426-0006/"}],"metrics":[{"other":{"content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","description":"Uncontrolled Resource Consumption","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2024-04-26T09:06:01.299Z"},"datePublic":"2022-12-14T00:00:00.000Z","x_redhatCweChain":"CWE-400: Uncontrolled Resource Consumption","timeline":[{"lang":"en","time":"2023-05-24T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2022-12-14T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Upstream acknowledges William Manley as the original reporter."}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2023-11-27T17:04:41.563399Z","id":"CVE-2023-32665","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-24T19:16:35.238Z"}},{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-32665","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211827","name":"RHBZ#2211827","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]},{"url":"https://gitlab.gnome.org/GNOME/glib/-/issues/2121","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html","tags":["x_transferred"]},{"url":"https://security.gentoo.org/glsa/202311-18","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20240426-0006/","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T15:25:36.651Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-14T23:17:13.566Z"},"x_adpType":"supplier"}]}}}