Vulnerability Description
A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition.
CVSS Score
5.5
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnome | Glib | < 2.62.5 |
| Debian | Debian Linux | 10.0 |
| Netapp | Active Iq Unified Manager | - |
Related Weaknesses (CWE)
References
- https://access.redhat.com/security/cve/CVE-2021-3800Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1938284Issue TrackingPatchThird Party Advisory
- https://gitlab.gnome.org/GNOME/glib/-/commit/3529bb4450a51995PatchVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/09/msg00020.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20221028-0004/Third Party Advisory
- https://www.openwall.com/lists/oss-security/2017/06/23/8ExploitMailing ListPatch
- https://access.redhat.com/security/cve/CVE-2021-3800Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1938284Issue TrackingPatchThird Party Advisory
- https://gitlab.gnome.org/GNOME/glib/-/commit/3529bb4450a51995PatchVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/09/msg00020.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20221028-0004/Third Party Advisory
- https://www.openwall.com/lists/oss-security/2017/06/23/8ExploitMailing ListPatch
FAQ
What is CVE-2021-3800?
CVE-2021-3800 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition.
How severe is CVE-2021-3800?
CVE-2021-3800 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-3800?
Check the references section above for vendor advisories and patch information. Affected products include: Gnome Glib, Debian Debian Linux, Netapp Active Iq Unified Manager.