Threat database

A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.

A security update has been released for libnbd, a userspace client library for Network Block Device (NBD) clients. The update addresses an improper certificate validation vulnerability in the NBD server (CVE-2024-7383). This vulnerability could affect the security of communications between NBD clients and servers. The issue has been rated as having moderate severity by Red Hat Product Security. A patch is available and should be applied to affected systems running Red Hat Enterprise Linux 9.4 and related variants.