CVE-2021-3800: debian debian_linux
CVSS: 5.5v3.1MediumModified
AliasesSUSE-SU-2022:0828-1UBUNTU-CVE-2021-3800USN-5189-1DEBIAN-CVE-2021-3800DLA-3110-1
Published 23-08-2022Last modified 03-08-2024
Vulnerability summary
CVE-2021-3800 is a medium (CVSS 5.5) vulnerability in debian debian_linux. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.8% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.5/10
010
Medium · v3.1 (NVD)EPSS score
0.56%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 23-08-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition.
CVSS metrics
3 scores · 3 sources · 1 versionMedium 5.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
+0.01 pp
From 0.56% on 19-09-2026
19-09-202619-10-2026
EPSS score0.56%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-552Files or Directories Accessible to External PartiesThe product makes files or directories accessible to unauthorized actors, even though they should not be.
Affected systems
Suse4 products
- glib2&distro=SUSE Linux Enterprise Server 12 SP5< 2.48.2-12.25.1
- glib2&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 2.48.2-12.25.1
- glib2&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 2.48.2-12.25.1
- glib2&distro=SUSE Linux Enterprise Workstation Extension 12 SP5< 2.48.2-12.25.1
Debian2 products
- glib2.0< 2.64.0-1 | < 2.58.3-2+deb10u4
- debian_linuxEOL10.0
Gnome1 product
- glib< 2.62.5 | ≥ 2.63.0, < 2.63.6
Netapp1 product
Ubuntu1 product
- glib2.0< 2.40.2-0ubuntu1.1+esm4 | < 2.48.2-0ubuntu4.8+esm1 | < 2.56.4-0ubuntu0.18.04.9
5 vendors · 9 products
References
14 links
- security.netapp.com/advisory/ntap-20221028-0004/Third Party Advisory
