Inappropriate Encoding for Output Context The advisory has been revoked - it doesn't affect any version of package libitm-static (opens in a new tab)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RHEL7-LIBITMSTATIC-1920950
- published2 Nov 2021
- disclosed1 Nov 2021
Introduced: 1 Nov 2021
CVE-2021-42694 (opens in a new tab)Amendment
The Red Hat security team deemed this advisory irrelevant for RHEL:7.
NVD Description
Note: Versions mentioned in the description apply only to the upstream libitm-static package and not the libitm-static package as distributed by RHEL.
An issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allows an adversary to produce source code identifiers such as function names using homoglyphs that render visually identical to a target identifier. Adversaries can leverage this to inject code via adversarial identifier definitions in upstream software dependencies invoked deceptively in downstream software. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard (all versions). Unless mitigated, an adversary could produce source code identifiers using homoglyph characters that render visually identical to but are distinct from a target identifier. In this way, an adversary could inject adversarial identifier definitions in upstream software that are not detected by human reviewers and are invoked deceptively in downstream software. The Unicode Consortium has documented this class of security vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms.
References
- https://access.redhat.com/security/cve/CVE-2021-42694
- https://trojansource.codes
- http://www.unicode.org/versions/Unicode14.0.0/
- http://www.openwall.com/lists/oss-security/2021/11/01/1
- http://www.openwall.com/lists/oss-security/2021/11/01/6
- https://cwe.mitre.org/data/definitions/1007.html
- https://security.gentoo.org/glsa/202210-09
- https://www.kb.cert.org/vuls/id/999008
- https://www.scyon.nl/post/trojans-in-your-source-code
- https://www.unicode.org/reports/tr36/
- https://www.unicode.org/reports/tr39/