critical
CVE-2021-46848
libtasn1: Out-of-bound access in ETYPE_OK
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, CBL-Mariner, Photon OS. Rated lower by Amazon (high), Red Hat (medium), AlmaLinux (medium), Oracle (medium), Rocky Linux (medium), Ubuntu (low).
Description
GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| CBL-Mariner 1.0 | libtasn1 | 0:4.14-3.cm1 |
| CBL-Mariner 2.0 | libtasn1 | 0:4.19.0-1.cm2 |
| Photon OS 2.0 | libtasn1 | 4.14-2.ph2 |
| Photon OS 3.0 | libtasn1 | 4.14-2.ph3 |
| Photon OS 4.0 | libtasn1, libtasn1-devel | 4.14-2.ph4 |
| alma 8 | libtasn1, libtasn1-devel, libtasn1-tools | 4.13-4.el8_7 |
| alma 9 | libtasn1, libtasn1-devel, libtasn1-tools | 4.16.0-8.el9_1 |
| alpine 3.14 | libtasn1 | 4.17.0-r1 |
| alpine 3.15 | libtasn1 | 4.18.0-r1 |
| alpine 3.16 | libtasn1 | 4.18.0-r1 |
| alpine 3.17 | libtasn1 | 4.19-r0 |
| alpine 3.18 | libtasn1 | 4.19-r0 |
Show all 79 entries from 48 sources
| Source | Package | Fixed in |
|---|---|---|
| CBL-Mariner 1.0 | libtasn1 | 0:4.14-3.cm1 |
| CBL-Mariner 2.0 | libtasn1 | 0:4.19.0-1.cm2 |
| Photon OS 2.0 | libtasn1 | 4.14-2.ph2 |
| Photon OS 3.0 | libtasn1 | 4.14-2.ph3 |
| Photon OS 4.0 | libtasn1 | 4.14-2.ph4 |
| Photon OS 4.0 | libtasn1-devel | 4.14-2.ph4 |
| alma 8 | libtasn1 | 4.13-4.el8_7 |
| alma 8 | libtasn1-devel | 4.13-4.el8_7 |
| alma 8 | libtasn1-tools | 4.13-4.el8_7 |
| alma 9 | libtasn1 | 4.16.0-8.el9_1 |
| alma 9 | libtasn1-devel | 4.16.0-8.el9_1 |
| alma 9 | libtasn1-tools | 4.16.0-8.el9_1 |
| alpine 3.14 | libtasn1 | 4.17.0-r1 |
| alpine 3.15 | libtasn1 | 4.18.0-r1 |
| alpine 3.16 | libtasn1 | 4.18.0-r1 |
| alpine 3.17 | libtasn1 | 4.19-r0 |
| alpine 3.18 | libtasn1 | 4.19-r0 |
| alpine 3.19 | libtasn1 | 4.19-r0 |
| alpine 3.20 | libtasn1 | 4.19-r0 |
| alpine 3.21 | libtasn1 | 4.19-r0 |
| alpine 3.22 | libtasn1 | 4.19-r0 |
| alpine 3.23 | libtasn1 | 4.19-r0 |
| alpine 3.24 | libtasn1 | 4.19-r0 |
| alpine edge | libtasn1 | 4.19-r0 |
| amazon linux 2 | libtasn1 | 4.10-1.amzn2.0.3 |
| amazon linux 2 | libtasn1-debuginfo | 4.10-1.amzn2.0.3 |
| amazon linux 2 | libtasn1-devel | 4.10-1.amzn2.0.3 |
| amazon linux 2 | libtasn1-tools | 4.10-1.amzn2.0.3 |
| amazon linux 2023 | libtasn1 | 4.19.0-1.amzn2023.0.1 |
| amazon linux 2023 | libtasn1-debuginfo | 4.19.0-1.amzn2023.0.1 |
| amazon linux 2023 | libtasn1-debugsource | 4.19.0-1.amzn2023.0.1 |
| amazon linux 2023 | libtasn1-devel | 4.19.0-1.amzn2023.0.1 |
| amazon linux 2023 | libtasn1-tools | 4.19.0-1.amzn2023.0.1 |
| amazon linux 2023 | libtasn1-tools-debuginfo | 4.19.0-1.amzn2023.0.1 |
| chainguard | libtasn1 | 0 |
| debian 10 | libtasn1-6 | 4.13-3+deb10u1 |
| debian 11 | libtasn1-6 | 4.16.0-2+deb11u1 |
| debian 12 | libtasn1-6 | 4.19.0-2 |
| debian 13 | libtasn1-6 | 4.19.0-2 |
| debian 14 | libtasn1-6 | 4.19.0-2 |
| echo | libtasn1-6 | 4.19.0-2 |
| Oracle Linux 8 | libtasn1 | 4.13-4.el8_7 |
| Oracle Linux 8 | libtasn1-devel | 4.13-4.el8_7 |
| Oracle Linux 8 | libtasn1-tools | 4.13-4.el8_7 |
| Oracle Linux 9 | libtasn1 | 4.16.0-8.el9_1 |
| Oracle Linux 9 | libtasn1-devel | 4.16.0-8.el9_1 |
| Oracle Linux 9 | libtasn1-tools | 4.16.0-8.el9_1 |
| rapidfort Oracle Linux 9 | libtasn1 | 0:4.16.0-8.el9_1 |
| rapidfort Oracle Linux 9 | libtasn1-devel | 0:4.16.0-8.el9_1 |
| rapidfort Oracle Linux 9 | libtasn1-tools | 0:4.16.0-8.el9_1 |
| rapidfort ubuntu 20.04 | libtasn1-6 | 0:4.18.0-4ubuntu0.2 |
| rapidfort ubuntu 20.04 | rf-libtasn1-6 | 0:4.18.0-4ubuntu0.2 |
| rapidfort ubuntu 22.04 | libtasn1-6 | 0:4.18.0-4ubuntu0.2 |
| rapidfort ubuntu 22.04 | rf-libtasn1-6 | 0:4.18.0-4ubuntu0.2 |
| rapidfort ubuntu 24.04 | libtasn1-6 | 0:4.18.0-4ubuntu0.2 |
| rapidfort ubuntu 24.04 | rf-libtasn1-6 | 0:4.18.0-4ubuntu0.2 |
| Red Hat | libtasn1 | no fix listed |
| Red Hat | libtasn1-devel | no fix listed |
| Red Hat | libtasn1-tools | no fix listed |
| rocky 8 | libtasn1 | 4.13-4.el8_7 |
| rocky 8 | libtasn1-devel | 4.13-4.el8_7 |
| rocky 8 | libtasn1-tools | 4.13-4.el8_7 |
| rocky 9 | libtasn1 | 4.16.0-8.el9_1 |
| rocky 9 | libtasn1-devel | 4.16.0-8.el9_1 |
| rocky 9 | libtasn1-tools | 4.16.0-8.el9_1 |
| root.io debian 11 | rootio-libtasn1-6 | 4.16.0-2+deb11u1 |
| root.io debian 12 | rootio-libtasn1-6 | 4.19.0-2 |
| root.io debian 13 | rootio-libtasn1-6 | 4.19.0-2 |
| seal Red Hat 6 | libtasn1 | 2.3-6.el6_5+sp999 |
| seal Red Hat 6 | seal-libtasn1 | 2.3-6.el6_5+sp999 |
| seal Red Hat 7 | libtasn1 | 4.10-1.el7+sp999 |
| seal Red Hat 7 | seal-libtasn1 | 4.10-1.el7+sp999 |
| seal Red Hat 8 | libtasn1 | 4.13-4.el8_7+sp999 |
| seal Red Hat 8 | seal-libtasn1 | 4.13-4.el8_7+sp999 |
| ubuntu 16.04-ESM | libtasn1-6 | 4.7-3ubuntu0.16.04.3+esm3 |
| ubuntu 18.04-ESM | libtasn1-6 | 4.13-2ubuntu0.1~esm1 |
| ubuntu 20.04-ESM | libtasn1-6 | 4.16.0-2ubuntu0.1+esm1 |
| ubuntu 22.04 | libtasn1-6 | 4.18.0-4ubuntu0.2 |
| wolfi | libtasn1 | 0 |
References
- https://access.redhat.com/errata/RHSA-2023:0343
- https://access.redhat.com/security/cve/CVE-2021-46848
- https://bugs.gentoo.org/866237
- https://bugzilla.redhat.com/2140058
- https://bugzilla.redhat.com/show_bug.cgi?id=2140058
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46848
All 25 references
- https://errata.almalinux.org/9/ALSA-2023-0343.html
- https://errata.rockylinux.org/RLSA-2023:0343
- https://gitlab.com/gnutls/libtasn1/-/commit/44a700d2051a666235748970c2df047ff207aeb5
- https://gitlab.com/gnutls/libtasn1/-/issues/32
- https://linux.oracle.com/cve/CVE-2021-46848.html
- https://linux.oracle.com/errata/ELSA-2023-0343.html
- https://lists.debian.org/debian-lts-announce/2023/01/msg00003.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AV4SHDJF2XLB4CUPTBPQQ6CLGZ5LKXPZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECM2ELTVRYV4BZ5L5GMIRQE27RFHPAQ6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGO7XST4EIJGX4B2ITZCYSWM24534BSU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V5LWOGF7QRMNFRUCZY6TDYQJVFI6MOQ2/
- https://nvd.nist.gov/vuln/detail/CVE-2021-46848
- https://security.netapp.com/advisory/ntap-20221118-0006/
- https://ubuntu.com/security/notices/USN-5707-1
- https://ubuntu.com/security/notices/USN-7954-1
- https://ubuntu.com/security/notices/USN-7954-2
- https://www.cve.org/CVERecord?id=CVE-2021-46848