CVE-2021-42341

Name
CVE-2021-42341
Description
checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced as part of OpenRC 0.44.0 development.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/OpenRC/openrc/issues/459
MISC https://github.com/OpenRC/openrc/commit/bb8334104baf4d5a4a442a8647fb9204738f2204
MISC https://bugs.gentoo.org/816900
MISC https://github.com/OpenRC/openrc/pull/462
MISC https://github.com/OpenRC/openrc/commit/63db2d99e730547339d1bdd28e8437999c380cae
MISC https://github.com/OpenRC/openrc/issues/418

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:openrc_project:openrc:*:*:*:*:*:*:*:* openrc >= 0.44.0 < 0.44.7

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
openrc edge-main 0.44.6-r1 Natanael Copa <ncopa@alpinelinux.org> fixed
openrc 3.22-main 0.44.6-r1 None fixed
openrc 3.21-main 0.44.6-r1 None fixed
openrc 3.20-main 0.44.6-r1 None fixed
openrc 3.19-main 0.44.6-r1 None fixed
openrc 3.18-main 0.44.6-r1 None fixed
openrc 3.17-main 0.44.6-r1 None fixed