[Bug nss/34015] gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames

[carlos at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=34015

Carlos O'Donell <carlos at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |2.44
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #5 from Carlos O'Donell <carlos at redhat dot com> ---
commit e10977481f4db4b2a3ce34fa4c3a1e26651ae312
Author: Carlos O'Donell <carlos@redhat.com>
Date:   Fri Mar 20 17:14:33 2026 -0400

    resolv: Check hostname for validity (CVE-2026-4438)

    The processed hostname in getanswer_ptr should be correctly checked to
    avoid invalid characters from being allowed, including shell
    metacharacters. It is a security issue to fail to check the returned
    hostname for validity.

    A regression test is added for invalid metacharacters and other cases
    of invalid or valid characters.

    No regressions on x86_64-linux-gnu.

    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>

-- 
You are receiving this mail because:
You are on the CC list for the bug.