CVE-2021-38165

Опубликовано: 07 авг. 2021

Источник: nvd

CVSS3: 5.3

CVSS2: 2.6

EPSS Низкий

Описание

Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.

Ссылки

http://www.openwall.com/lists/oss-security/2021/08/07/11
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/08/07/12
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/08/07/9
Mailing List
Third Party Advisory
https://bugs.debian.org/991971
Issue Tracking
Third Party Advisory
https://github.com/w3c/libwww/blob/f010b4cc58d32f34b162f0084fe093f7097a61f0/Library/src/HTParse.c#L118
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/08/msg00010.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7YMUHFJJWTZ6HBHTYXVDPNZINGGURHDW/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K6PZF7JNTFCOJ62HXZG4Q2NEHSZ6IO2V/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKNK7GQBJBUBMJVNKVC7RTCYWUYMFJQW/
https://lynx.invisible-island.net/current/CHANGES.html
Release Notes
Third Party Advisory
https://www.debian.org/security/2021/dsa-4953
Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/08/07/1
Mailing List
Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/08/07/11
Mailing List
http://www.openwall.com/lists/oss-security/2021/08/07/11
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/08/07/12
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/08/07/9
Mailing List
Third Party Advisory
https://bugs.debian.org/991971
Issue Tracking
Third Party Advisory
https://github.com/w3c/libwww/blob/f010b4cc58d32f34b162f0084fe093f7097a61f0/Library/src/HTParse.c#L118
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/08/msg00010.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7YMUHFJJWTZ6HBHTYXVDPNZINGGURHDW/

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:lynx_project:lynx:*:*:*:*:*:*:*:*

Версия до 2.8.9 (включая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

EPSS

Процентиль: 89%

0.04281

Низкий

5.3 Medium

CVSS3

2.6 Low

CVSS2

Дефекты

CWE-522

Связанные уязвимости

CVE-2021-38165

CVSS3: 5.3

ubuntu

больше 4 лет назад

Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.

CVE-2021-38165

CVSS3: 5.3

redhat

больше 4 лет назад

Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.

CVE-2021-38165

CVSS3: 5.3

debian

больше 4 лет назад

Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, whic ...

GHSA-88f3-hp86-v36f

github

больше 3 лет назад

Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.

BDU:2022-00255

CVSS3: 5.3

fstec

больше 4 лет назад

Уязвимость подкомпонента userinfo текстового веб-браузера Lynx, связанная с недостаточной защитой регистрационных данных, позволяющая нарушителю получить доступ к конфиденциальным данным

EPSS

Процентиль: 89%

0.04281

Низкий

5.3 Medium

CVSS3

2.6 Low

CVSS2

Дефекты

CWE-522