CVE-2021-43396: High severity gnu c library (glibc) vulnerability

Published Nov 4, 2021

Updated

DISPUTED In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug."

Affected Software

10 affected components

GNU glibc=2.34

Oracle Communications Cloud Native Core Binding Support Function=22.1.3

Oracle Communications Cloud Native Core Network Function Cloud Native Environment=22.1.0

Oracle Communications Cloud Native Core Network Repository Function=22.1.2

Oracle Communications Cloud Native Core Network Repository Function=22.2.0

Oracle Communications Cloud Native Core Security Edge Protection Proxy=22.1.1

Oracle Communications Cloud Native Core Unified Data Repository=22.2.0

Oracle Enterprise Operations Monitor=4.3

Oracle Enterprise Operations Monitor=4.4

Oracle Enterprise Operations Monitor=5.0

Remediation

Patch Available

https://www.oracle.com/security-alerts/cpujul2022.html

Event History

Nov 4, 2021

CVE Published

via MITRE·07:52 PM

Data Sourced

via MITRE·07:52 PM

Description

Disputed

08:15 PM

Data Sourced

via NVD·08:15 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is CVE-2021-43396?

CVE-2021-43396 is a vulnerability in the GNU C Library (glibc) 2.34 that allows remote attackers to force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data, potentially affecting data integrity.

What is the severity of CVE-2021-43396?

CVE-2021-43396 has a severity rating of 7.5 (High).

How does CVE-2021-43396 affect GNU C Library (glibc)?

CVE-2021-43396 affects glibc version 2.34 by allowing remote attackers to manipulate iconv() to emit a spurious '\0' character, which can impact data integrity in certain use cases.

How can the CVE-2021-43396 vulnerability be fixed?

A fix for CVE-2021-43396 has not been released at this time. It is recommended to update to a version of glibc that addresses this vulnerability when it becomes available.

Where can I find more information about CVE-2021-43396?

For more information about CVE-2021-43396, you can refer to the following sources: [link1], [link2], [link3].