CVE-2018-19591

Name of the Vulnerable Software and Affected Versions glibc versions through 2.28

Description The issue is related to insufficient input validation in the getaddrinfo function, which can lead to the invocation of the if nametoindex() function with incorrect parameters. This can be exploited by a remote attacker to cause memory exhaustion in the target system. The problem arises when attempting to resolve a crafted hostname via getaddrinfo(), resulting in the allocation of a socket descriptor that is not closed.

Recommendations For versions through 2.28, consider restricting the use of the getaddrinfo() function until a patch is available. As a temporary workaround, avoid using the getaddrinfo() function with untrusted hostnames to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.