CVE-2021-3998

Description

A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data.

CVSS breakdown

Affected products

• gnu / glibc2.33 – 2.35
• NetApp / h300s_firmware
• NetApp / h410c_firmware
• NetApp / h410s_firmware
• NetApp / h500s_firmware
• NetApp / h700s_firmware
• NetApp / ONTAP Select Deploy administration utility

References

• MAILING_LISThttps://www.openwall.com/lists/oss-security/2022/01/24/4
• MISChttps://sourceware.org/bugzilla/show_bug.cgi?id=28770
• MISChttps://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ee8d5e33adb284601c00c94687bc907e10aec9bb
• MISChttps://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=84d2d0fe20bdf94feed82b21b4d7d136db471f03
• MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2024633
• VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2021-3998
• VENDOR_ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2021-3998
• MISChttps://security.netapp.com/advisory/ntap-20221020-0003/