CVE-2021-43396 Other in n/a
A bug in glibc's iconv function can emit spurious null characters during ISO-2022-JP-3 conversion, potentially affecting data integrity, though vendor claims no security impact.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-43396?
CVE-2021-43396 is a high-severity vulnerability in Gnu Glibc, published on 4 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.
Which versions are affected by CVE-2021-43396?
It affects 7 products.
Products include Gnu Glibc, Oracle Communications Cloud Native Core Binding Support Function, Oracle Communications Cloud Native Core Network Function Cloud Native Environment, Oracle Communications Cloud Native Core Network Repository Function, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications Cloud Native Core Unified Data Repository and 1 more.
How do I fix CVE-2021-43396?
No fix published yet.
Is CVE-2021-43396 being exploited?
There is no known exploitation of CVE-2021-43396 in the wild and no public exploit code.
Other vulnerabilities in Gnu Glibc
Sources
Also known as AZL-6443, DEBIAN-CVE-2021-43396, GHSA-73g2-m4v3-6c2h, MINI-236x-9gmr-w9mj, OESA-2021-1438.