Segv on unknown address in kh_get_ucl_hash_caseless_node in libucl
Summary
OSV-2023-747: Segv on unknown address in kh_get_ucl_hash_caseless_node. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libucl is an open-source library that provides a parser and an object model for the Universal Configuration Language (UCL). It is commonly used for parsing configuration files in various applications. The library allows developers to read, modify, and generate UCL data structures. However, a vulnerability has been discovered in libucl that can lead to a segmentation fault (segv) when accessing an unknown address in the kh_get_ucl_hash_caseless_node function.
Vulnerability Detail
The vulnerability in libucl arises from a segmentation fault that occurs when attempting to access an unknown address in the kh_get_ucl_hash_caseless_node function. This can be triggered by a specially crafted input, potentially leading to a denial of service (DoS) or arbitrary code execution. The crash state indicates that the issue lies within the ucl_hash_search and ucl_include_file_single functions. The severity of the vulnerability is currently unknown.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
At the moment, no specific workaround has been provided for this vulnerability. It is advised to monitor the official libucl repository for updates and apply the patch as soon as it becomes available.
Conclusion
In conclusion, a vulnerability has been identified in libucl that can result in a segmentation fault when accessing an unknown address. This vulnerability may have serious consequences, including denial of service or arbitrary code execution. It is crucial to stay informed about the progress of the fix and apply the patch as soon as it becomes available. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for libucl →
FAQ
libucl is an open-source library for parsing and manipulating Universal Configuration Language (UCL) data structures.
The vulnerability can potentially lead to a denial of service (DoS) or arbitrary code execution if exploited.
The maintainers of libucl are actively working on resolving the issue and a fix is expected to be released soon.
The specific versions affected by this vulnerability have not been disclosed. It is recommended to update to the latest version once a fix is available.
You can monitor the official libucl repository for updates and announcements regarding the resolution of this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for libucl.
