CVE-2021-38165: debian debian_linux Insufficiently Protected Credentials
Vulnerability summary
CVE-2021-38165 is a medium (CVSS 5.3) Insufficiently Protected Credentials vulnerability in debian debian_linux. EPSS estimates a 3.94% chance of exploitation in the next 30 days, higher than 90.4% of scored vulnerabilities.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 07-08-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · Red hatEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS trend
Probability
3.94%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
Decrease -0.16 pp
From 4.10% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat3 products
- lynx< 0:2.8.9-4.el8
- lynx-debuginfo< 0:2.8.9-4.el8
- lynx-debugsource< 0:2.8.9-4.el8
Debian2 products
- lynx< 2.8.9rel.1-3+deb10u1 | < 2.8.9dev11-1+deb9u1 | < 2.9.0dev.6-3
- debian_linuxEOL9.0 | 10.0
Alpine1 product
- lynx< 2.8.9_p1-r3
Fedoraproject1 product
- fedoraEOL33 | 34 | 35
Lynx_project1 product
- lynx≤ 2.8.9
Mageia1 product
- lynx< 2.8.9-0.dev17.4.1.mga8
Ubuntu1 product
- lynx< 2.8.9dev8-4ubuntu1+esm2 | < 2.8.9dev16-3ubuntu0.1~esm1 | < 2.9.0dev.5-1ubuntu0.1~esm1
7 vendors · 10 products
References
31 links
- www.openwall.com/lists/oss-security/2021/08/07/1X Refsource MISCREPORTMailing ListThird Party Advisory
- lynx.invisible-island.net/current/CHANGES.htmlX Refsource MISCREPORTRelease NotesThird Party Advisory
- github.com/w3c/libwww/blob/f010b4cc58d32f34b162f0084fe093f7097a61f0/Library/src/HTParse.cX Refsource MISCREPORTThird Party Advisory
- www.openwall.com/lists/oss-security/2021/08/07/9Mailing ListX Refsource MLISTREPORTThird Party Advisory
- lists.debian.org/debian-lts-announce/2021/08/msg00010.htmlMailing ListX Refsource MLISTThird Party Advisory
