CVE-2021-42694
Description
A flaw was found in the way Unicode standards are implemented in the context of development environments, which have specialized requirements for rendering text. Homoglyphs are different Unicode characters that, to the naked eye, look the same. An attacker could use homoglyphs to deceive a human reviewer by creating a malicious patch containing functions that look similar to standard library functions, such as print, but replace one character with a homoglyph. This function can then be defined in an upstream dependency to launch source code-related attacks.
Security Bulletin
Statement
The vulnerability is classified as moderate severity because it relies on social engineering and visual deception rather than exploiting a technical flaw in the software itself. While homoglyph-based attacks can deceive human reviewers, the impact is limited to cases where the code is not adequately reviewed or where automated tools fail to detect suspicious Unicode characters. Unlike higher-severity vulnerabilities, which may allow direct exploitation of system resources or escalation of privileges, this issue primarily targets code readability and review processes.
Additionally, it is important to note that this vulnerability does not affect Red Hat products, as it arises from the broader issue of Unicode handling in development environments rather than a flaw in Red Hat's implementations.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.3 | 8.3 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | High | High | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | Required | Required | N/A |
| Scope | Changed | Changed | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | High | High | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Modify Application Data; Execute Unauthorized Code or Commands
An attacker could modify the structure of the message or data being sent to the downstream component, possibly injecting commands.
Acknowledgements
Red Hat would like to thank Nicholas Boucher and Ross Anderson (University of Cambridge) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
