Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-4217

CVE-2021-4217: A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings,...

7.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-4217
GHSA ID
GHSA-9xxw-h585-3vfj
EPSS Score
0.34487%
CWE
CWE-476
Published
8/25/2022
Updated
2/1/2023
KEV Status
No
Technology
-

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerable functions were identified primarily from the Valgrind output provided in the Launchpad bug report (https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1957077), which is directly associated with CVE-2021-4217. The Valgrind trace clearly shows the call stack at the moment of the crash (SIGSEGV due to null pointer dereference in getUnicodeData when calling strlen) and also points to the origin of uninitialized data in do_string. The function getZip64Data is also shown to be affected by this uninitialized data. The description of the patch ('Fix null pointer dereference and use of uninitialized data') further corroborates that these are the key areas affected by the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *l*w w*s *oun* in unzip. T** vuln*r**ility o**urs *u* to improp*r **n*lin* o* Uni*o** strin*s, w*i** **n l*** to * null point*r **r***r*n**. T*is *l*w *llows *n *tt**k*r to input * sp**i*lly *r**t** zip *il*, l***in* to * *r*s* or *o** *x**ution.

Reasoning

T** vuln*r**l* *un*tions w*r* i**nti*i** prim*rily *rom t** V*l*rin* output provi*** in t** L*un**p** *u* r*port (*ttps://*u*s.l*un**p**.n*t/u*untu/+sour**/unzip/+*u*/*******), w*i** is *ir**tly *sso*i*t** wit* *V*-****-****. T** V*l*rin* tr*** *l**r