Vulnerability Description
An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnome | Glib | < 2.78.5 |
| Debian | Debian Linux | 10.0 |
| Fedoraproject | Fedora | 39 |
| Netapp | Ontap Tools | 10 |
Related Weaknesses (CWE)
References
- https://gitlab.gnome.org/GNOME/glib/-/issues/3268ExploitIssue TrackingVendor Advisory
- https://lists.debian.org/debian-lts-announce/2024/05/msg00008.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20240531-0008/Third Party Advisory
- https://www.openwall.com/lists/oss-security/2024/05/07/5Mailing List
- https://gitlab.gnome.org/GNOME/glib/-/issues/3268ExploitIssue TrackingVendor Advisory
- https://lists.debian.org/debian-lts-announce/2024/05/msg00008.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]
FAQ
What is CVE-2024-34397?
CVE-2024-34397 is a vulnerability with a CVSS score of 5.2 (MEDIUM). An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shar...
How severe is CVE-2024-34397?
CVE-2024-34397 has been rated MEDIUM with a CVSS base score of 5.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-34397?
Check the references section above for vendor advisories and patch information. Affected products include: Gnome Glib, Debian Debian Linux, Fedoraproject Fedora, Netapp Ontap Tools.