[PATCH 2/2] Add advisory text for CVE-2026-4438

[Adhemerval Zanella Netto]

On 20/03/26 16:47, Carlos O'Donell wrote:
> Explain the security issue and set the context for the vulnerability to
> help downstreams get a better understanding of the issue.
> ---
>  advisories/GLIBC-SA-2026-0006 | 25 +++++++++++++++++++++++++
>  1 file changed, 25 insertions(+)
>  create mode 100644 advisories/GLIBC-SA-2026-0006
> 
> diff --git a/advisories/GLIBC-SA-2026-0006 b/advisories/GLIBC-SA-2026-0006
> new file mode 100644
> index 0000000000..9d81bb8093
> --- /dev/null
> +++ b/advisories/GLIBC-SA-2026-0006
> @@ -0,0 +1,25 @@
> +gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
> +
> +Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf
> +that specifies the library's DNS backend in the GNU C library version
> +2.34 to version 2.43 could result in an invalid DNS hostname being
> +returned to the caller in violation of the DNS specification.
> +
> +A defect in the getanswer_ptr function, which implements the iteration
> +and extraction of the answer from a DNS response, can cause it to accept
> +an invalid DNS hostname that can contain shell metacharacters. An
> +application that uses the returned hostname in a shell, without guarding
> +for shell expansion, may be subject to shell injection attacks.  At the
> +time of publication, no known affected DNS server returns results with
> +shell metacharacters in the results.  An attacker would either need to
> +be network adjacent or have compromised the DNS server to use this
> +defect for shell injection.  No known vulnerable application has been
> +identified. 
> +

LGTM, with date fixed as you already pointed out.

Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>

> +CVE-Id: CVE-2026-4438
> +Public-Date: 2026-03-19
> +Vulnerable-Commit: 32e5db37684ffcbc6ae34fcc6cdcf28670506baa (2.34-323)
> +Vulnerable-Commit: def97e7f71a07517810f7263213d607e08ad21f1 (2.35-188)
> +Vulnerable-Commit: 77f523c473878ec0051582ef15161c6982879095 (2.36-30)
> +Vulnerable-Commit: e32547d661a43da63368e488b6cfa9c53b4dcf92 (2.37)
> +Reported-by: Antonio Maini (0rbitingZer0) - 0rbitingZer0@proton.me