Input validation error in Unicode - CVE-2021-42694

Vulnerability details

The vulnerability allows an attacker to bypass certain security checks.

The vulnerability exists in the character definitions of the Unicode Specification. The specification allows an attacker to produce source code identifiers such as function names using homoglyphs that render visually identical to a target identifier. Adversaries can leverage this to inject code via adversarial identifier definitions in upstream software dependencies invoked deceptively in downstream software.

Affected software

How to mitigate CVE-2021-42694

Links to Public Exploits and PoC-codes

• Exploit #9337 - CVE-2021-42694 (Generate malicious files using recently published homoglyphic-attack (CVE-2021-42694)) (September 18, 2023)
• Exploit #6981 - CVE-2021-42694 (Generate malicious files using recently published homoglyphic-attack (CVE-2021-42694)) (November 3, 2021)

External References

• https://trojansource.codes
• http://www.openwall.com/lists/oss-security/2021/11/01/1
• http://www.openwall.com/lists/oss-security/2021/11/01/6

Related Security Bulletins

• Improper input validation in Unicode character definitions
• Security restrictions bypass in Rust Unicode implementation
• Multiple vulnerabilities in Dell Container Storage Modules
• Multiple vulnerabilities in IBM Cloud Transformation Advisor