Published: 03/02/2023 Updated: 02/03/2023

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 0

sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string. For example, 1,234,567 (with padding to 13) overflows by two bytes.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu glibc 2.37

DescriptionA vulnerability was found in glibc When the printf family of functions is called with a format specifier that uses an apostrophe (enable grouping) and a minimum width specifier, the resulting output could be larger than reasonably expected by a caller that computed a tight bound on the buffer size The resulting larger-than-expec ...

buffer overflow in sprintf(3) due to a regression where after the refactor the implementation does not account for grouping characters during padding of the width ...

Critical Infrastructure Sectors: Critical Manufacturing

Dependency Package Data Microservice - Read

ortelius-ms-dep-pkg-r Dependency Package Data Microservice - Read This is a flask web application which returns a list of objects known as Component Dependencies when the endpoint /msapi/deppkg is accessed Setup Clone the repository on your local computer Start Postgres The project requires a Postgres server to be running This can be done by either installing Postgre

Dependency Package Data Microservice - Create, Update and Delete

ortelius-ms-dep-pkg-cud Dependency Package Data Microservice - Create, Update and Delete HELM_CHART port:8080 package name : deppkg postgress test database docker image Pull and run the above image Create Table Componentdep SQL Query Microservice url: localhost:5000/msapi/deppkg methods: POST sample call: curl -X POST - -H "Content-Type: application/json"

Dependency Package Data Microservice - Read

ortelius-ms-dep-pkg-r Dependency Package Data Microservice - Read This is a flask web application which returns a list of objects known as Component Dependencies when the endpoint /msapi/deppkg is accessed Setup Clone the repository on your local computer Start Postgres The project requires a Postgres server to be running This can be done by either installing Postgre

Microservice for uploading Readme, SBOM, License File, Swagger and other DevOps and Supply Chain Intelligence.

ortelius-ms-textfile-crud Fixed CVEs 2/27/23 - CVE-2023-25139 3/28/23 - CVE-2023-0464

Microservice to upload attributes gathered from the CI/CD Pipeline such as Key Value pairs.

ortelius-ms-compitem-crud Component Details Microservice - CRUD API LIST Three types of APIs are supported at the moment Add list of component item curl localhost:5000/msapi/compitem?comp_id=255 Returns: [{"id": 361, "compid": 255, "buildid": "", "buildurl": "", "dock

ortelius-ms-sbom-export Dependency Package Data Microservice - Read This is a flask web application which returns a list of objects known as Component Dependencies when the endpoint /msapi/deppkg is accessed Setup Clone the repository on your local computer Start Postgres The project requires a Postgres server to be running This can be done by either installing Postg

Microservice for viewing DORA metrics.

ortelius-ms-scorecard Fixed CVEs 2/27/23 - CVE-2023-25139

Microservice for viewing DORA metrics.

ortelius-ms-scorecard Fixed CVEs 2/27/23 - CVE-2023-25139

CWE-787 https://sourceware.org/bugzilla/show_bug.cgi?id=30068 http://www.openwall.com/lists/oss-security/2023/02/10/1 https://security.netapp.com/advisory/ntap-20230302-0010/https://nvd.nist.gov https://github.com/ortelius/ortelius-ms-dep-pkg-r https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10 https://access.redhat.com/security/cve/cve-2023-25139

CVE-2023-25139

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect