CVE-2024-34397 is a vulnerability in GNOME GLib where a GDBus-based client subscribing to signals from a trusted system service (e.g., NetworkManager) on a shared computer can be tricked by other local users sending spoofed D-Bus signals. The client may wrongly interpret these spoofed signals as coming from the trusted service, potentially causing incorrect behavior. This vulnerability is classified under CWE-940 (Improper Verification of Source of a Communication Channel), CWE-193, and CWE-124. Red Hat has released version 3.5.1 of the OpenShift distributed tracing platform (Jaeger) including fixes for this and other CVEs. The advisory indicates the vulnerability has a medium severity rating and no known exploits in the wild. The vendor provides official fixes and instructions for upgrading.

The vulnerability allows local users on a shared system to spoof D-Bus signals to GDBus-based clients, potentially causing those clients to behave incorrectly. The impact varies depending on the application using the GDBus client but could include privilege escalation or bypassing protection mechanisms. Red Hat rates the severity as medium with a CVSS base score of 3.8 (Red Hat scoring). No known active exploitation has been reported.

Red Hat has released an official fixed version 3.5.1 of the OpenShift distributed tracing platform (Jaeger) that addresses this vulnerability. Users should upgrade to this version following Red Hat's documented upgrade procedures. No additional mitigations or workarounds are specified or required beyond applying the official update.