CVE Vulnerabilities

CVE-2021-46848

Off-by-one Error

Published: Oct 24, 2022 | Modified: Nov 07, 2023
CVSS 3.x
9.1
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
5.9 MODERATE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
LOW

GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.

Weakness

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Affected Software

Name Vendor Start Version End Version
Libtasn1 Gnu * 4.19.0 (excluding)
Red Hat Enterprise Linux 8 RedHat libtasn1-0:4.13-4.el8_7 *
Red Hat Enterprise Linux 8 RedHat libtasn1-0:4.13-4.el8_7 *
Red Hat Enterprise Linux 8.6 Extended Update Support RedHat libtasn1-0:4.13-3.el8_6.1 *
Red Hat Enterprise Linux 9 RedHat libtasn1-0:4.16.0-8.el9_1 *
Red Hat Enterprise Linux 9 RedHat libtasn1-0:4.16.0-8.el9_1 *
Libtasn1-6 Ubuntu bionic *
Libtasn1-6 Ubuntu esm-infra/xenial *
Libtasn1-6 Ubuntu kinetic *
Libtasn1-6 Ubuntu lunar *
Libtasn1-6 Ubuntu trusty *
Libtasn1-6 Ubuntu trusty/esm *
Libtasn1-6 Ubuntu upstream *
Libtasn1-6 Ubuntu xenial *

Potential Mitigations

References