[PATCH 2/2] Add advisory text for CVE-2026-4438

[Carlos O'Donell]

On 3/23/26 8:30 AM, Adhemerval Zanella Netto wrote:
> 
> 
> On 20/03/26 16:47, Carlos O'Donell wrote:
>> Explain the security issue and set the context for the vulnerability to
>> help downstreams get a better understanding of the issue.
>> ---
>>   advisories/GLIBC-SA-2026-0006 | 25 +++++++++++++++++++++++++
>>   1 file changed, 25 insertions(+)
>>   create mode 100644 advisories/GLIBC-SA-2026-0006
>>
>> diff --git a/advisories/GLIBC-SA-2026-0006 b/advisories/GLIBC-SA-2026-0006
>> new file mode 100644
>> index 0000000000..9d81bb8093
>> --- /dev/null
>> +++ b/advisories/GLIBC-SA-2026-0006
>> @@ -0,0 +1,25 @@
>> +gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
>> +
>> +Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf
>> +that specifies the library's DNS backend in the GNU C library version
>> +2.34 to version 2.43 could result in an invalid DNS hostname being
>> +returned to the caller in violation of the DNS specification.
>> +
>> +A defect in the getanswer_ptr function, which implements the iteration
>> +and extraction of the answer from a DNS response, can cause it to accept
>> +an invalid DNS hostname that can contain shell metacharacters. An
>> +application that uses the returned hostname in a shell, without guarding
>> +for shell expansion, may be subject to shell injection attacks.  At the
>> +time of publication, no known affected DNS server returns results with
>> +shell metacharacters in the results.  An attacker would either need to
>> +be network adjacent or have compromised the DNS server to use this
>> +defect for shell injection.  No known vulnerable application has been
>> +identified.
>> +
> 
> LGTM, with date fixed as you already pointed out.
> 
> Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>

Thanks! Pushed.
  
>> +CVE-Id: CVE-2026-4438
>> +Public-Date: 2026-03-19
>> +Vulnerable-Commit: 32e5db37684ffcbc6ae34fcc6cdcf28670506baa (2.34-323)
>> +Vulnerable-Commit: def97e7f71a07517810f7263213d607e08ad21f1 (2.35-188)
>> +Vulnerable-Commit: 77f523c473878ec0051582ef15161c6982879095 (2.36-30)
>> +Vulnerable-Commit: e32547d661a43da63368e488b6cfa9c53b4dcf92 (2.37)
>> +Reported-by: Antonio Maini (0rbitingZer0) - 0rbitingZer0@proton.me
> 


-- 
Cheers,
Carlos.