CVE-2021-43396
Description
In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gnu glibc | 2.34 | — |
| oracle communications_cloud_native_core_binding_support_function | 22.1.3 | — |
| oracle communications_cloud_native_core_network_function_cloud_native_environment | 22.1.0 | — |
| oracle communications_cloud_native_core_network_repository_function | 22.1.2, 22.2.0 | — |
| oracle communications_cloud_native_core_security_edge_protection_proxy | 22.1.1 | — |
| oracle communications_cloud_native_core_unified_data_repository | 22.2.0 | — |
| oracle enterprise_operations_monitor | 4.3, 4.4, 5.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.