{ "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json", "document": { "category": "csaf_security_advisory", "csaf_version": "2.1", "distribution": { "tlp": { "label": "AMBER" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Generated from an analysis of SBOM cyclonedx.json (cyclonedx-json, sha256 0b7256c1504e598e3be00fc48ebba0a19e2f94d73b9357ca7193838bdda21c5c)." }, { "category": "general", "text": "This advisory is based on an INCOMPLETE analysis. The following analyzers did not produce results, so components they would have covered may carry vulnerabilities not listed here: shieldbom (fail).", "title": "Analysis coverage" } ], "publisher": { "category": "vendor", "contact_details": "security@ndaal.eu", "name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG", "namespace": "https://ndaal.eu/csaf" }, "references": [ { "category": "self", "summary": "This advisory", "url": "https://ndaal.eu/csaf/ndaal-sba-1239-0178" } ], "title": "Vulnerabilities found in SBOM cyclonedx.json", "tracking": { "current_release_date": "2026-09-01T17:01:35Z", "generator": { "engine": { "name": "ndaal SBOM Auditor", "version": "1.4.18" } }, "id": "ndaal-sba-1239-0178", "initial_release_date": "2026-09-01T17:01:35Z", "revision_history": [ { "date": "2026-09-01T17:01:35Z", "number": "1.0.0", "summary": "Initial advisory generated from an SBOM analysis." } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "full_product_names": [ { "name": "glibc-common@2.34-100.0.1.el9_4.3", "product_id": "CSAFPID-0001", "product_identification_helper": { "purls": [ "pkg:rpm/ol/glibc-common@2.34-100.0.1.el9_4.3?arch=x86_64&upstream=glibc-2.34-100.0.1.el9_4.3.src.rpm&distro=ol-9.4" ] } } ] }, "vulnerabilities": [ { "cve": "CVE-2026-4046", "notes": [ { "category": "description", "text": "[2.34-270.0.1]\n- Forward-port Oracle patches for ol9-u8\n Reviewed-by: Jose E. Marchesi \n Oracle history:\n May-20-2026 Cupertino Miranda - 2.34-266.0.1\n - Forward-port Oracle patches for ol9-u8\n Reviewed-by: David Faust \n March-25-2026 Cupertino Miranda - 2.34-262.0.1\n - Forward-port Oracle patches for ol9-u8\n Reviewed-by: David Faust \n March-6-2026 Cupertino Miranda - 2.34-256.0.1\n - Forward-port Oracle patches for ol9-u8\n Reviewed-by: David Faust \n February-3-2026 Cupertino Miranda - 2.34-245.0.1\n - Forward-port Oracle patches for ol9-u8\n Reviewed-by: David Faust \n November-14-2025 Cupertino Miranda - 2.34-231.0.1.1\n - Forward-port Oracle patches for ol9-u7\n Reviewed-by: Jose E. Marchesi \n September-24-2025 Cupertino Miranda - 2.34-231.0.1\n - Forward-port Oracle patches for ol9-u7\n Reviewed-by: Jose E. Marchesi \n September-8-2025 Jose E. Marchesi - 2.34-228.0.1\n - Forward-port Oracle patches for ol9-u7\n Reviewed-by: Jose E. Marchesi \n August-5-2025 Cupertino Miranda - 2.34-217.0.1\n - Forward-port Oralce patches for ol9-u7\n Reviewed-by: Jose E. Marchesi \n August-5-2025 Cupertino Miranda - 2.34-168.0.1.23\n - Forward-port Oracle patches for ol9-u6\n Reviewed-by: Jose E. Marchesi \n June-30-2025 Cupertino Miranda - 2.34-168.0.1.20\n - Forward-port Oracle patches for ol9-u6\n Reviewed-by: Jose E. Marchesi \n June-9-2025 Cupertino Miranda - 2.34-168.0.1.19\n - Forward-port Oracle patches for ol9-u6\n Reviewed-by: David Faust \n May-17-2025 Cupertino Miranda - 2.34-168.0.1.14\n - Forward-port Oracle patches for ol9-u6\n Reviewed-by: Jose E. Marchesi \n March-6-2025 Cupertino Miranda - 2.34-168.0.1\n - Forward-port Oracle patches for ol9-u6\n Reviewed by: Jose E. Marchesi \n February-18-2025 Cupertino Miranda - 2.34-160.0.1\n - Forward-port Oracle patches for ol9-u6 DP\n Reviewed by: Jose E. Marchesi \n November-12-2024 Cupertino Miranda - 2.34-125.0.1.1\n - Forward-port Oracle patches for ol9-u5\n Reviewed by: Jose E. Marchesi \n October-1-2024 Cupertino Miranda - 2.34-100.0.1.4\n - Forward-port Oracle patches for ol9-u4\n Reviewed by: David Faust \n August-26-2024 Jose E. Marchesi - 2.34-100.0.1.3\n - Forward-port Oracle patches for ol9-u4\n Reviewed by: David Faust \n May-24-2024 Cupertino Miranda - 2.34-100.0.1.2\n - Forward-port Oracle patches for ol9-u4\n Reviewed by: Jose E. Marchesi \n April-30-2024 Cupertino Miranda - 2.34-100.0.1\n - Forward-port Oracle patches for ol9-u4\n Reviewed by: Indu Bhagat \n March-28-2024 Cupertino Miranda - 2.34-100.0.1\n - Forward-port Oracle patches for ol9-u4-beta\n Reviewed by: Jose E. Marchesi \n March 15 2024 Cupertino Miranda - 2.34-83.0.2.12\n - Forward-port Oracle patches for ol9\n Reviewed by: Jose E. Marchesi \n February-26-2024 Cupertino Miranda - 2.34-83.0.2.7\n - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family\n Reviewed by: Jose E. Marchesi \n October-24-2023 Cupertino Miranda - 2.34-83.0.1.7\n - Forward-port Oracle patches for ol9\n Reviewed by: Jose E. Marchesi \n October-4-2023 Cupertino Miranda - 2.34-82.0.1\n - Forward-port Oracle patches for ol9\n Reviewed by: Jose E. Marchesi \n April-18-2023 Cupertino Miranda - 2.34-60.0.2\n - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks\n - Created tunable glibc.pthread.stack_hugetlb to control when hugepages\n can be used for stack allocation.\n - In case THP are enabled and glibc.pthread.stack_hugetlb is set to\n 0, glibc will madvise the kernel not to use allow hugepages for stack\n allocations.\n Reviewed by: Jose E. Marchesi \n March-28-2023 Cupertino Miranda - 2.34-60.0.1\n - Merge Oracle patches for ol9-u2 beta\n Reviewed by: Jose E. Marchesi \n September-28-2022 Patrick McGehearty - 2.34-40.0.1\n - Merge Oracle patches for ol9-u1 beta\n Reviewed by: Jose E. Marchesi \n April-25-2022 Patrick McGehearty - 2.34-28.0.1\n - Merge Oracle patches with ol9 beta\n - Reviewed-by: Jose E. Marchesi \n\n[2.34-270]\n- Fix incorrect setting of CXX variable in spec file (RHEL-148252)\n\n[2.34-269]\n- Fix __nss_get_default_domain logic to restore netgroup user enumeration\n (RHEL-168096)\n\n[2.34-268]\n- resolv: Correctly count records and check hostname validity (RHEL-168851,\n RHEL-168852)\n\n[2.34-267]\n- CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules\n (RHEL-162901)" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "title": "ELSA-2026-20597", "remediations": [ { "category": "vendor_fix", "details": "Upgrade to 0:2.34-270.0.1.el9_8 or later.", "product_ids": [ "CSAFPID-0001" ] } ] } ] }