CVE-2021-4217
Summary
| CVE | CVE-2021-4217 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-08-24 16:15:10 UTC |
| Updated | 2026-11-02 19:17:46 UTC |
| Description | A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. |
Risk And Classification
Primary CVSS: v3.1 3.3 LOW from [email protected]
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
EPSS: 0.006230000 probability, percentile 0.498680000 (date 2026-11-02)
Problem Types: CWE-476 | CWE-476 CWE-476 - NULL Pointer Dereference
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Fedoraproject | Fedora | 35 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 9.0 | All | All | All |
| Application | Unzip Project | Unzip | 6.0 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Bug #1957077 “SIGSEGV during processing of unicode string” : Bugs : unzip package : Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | bugs.launchpad.net | Exploit, Issue Tracking, Patch, Third Party Advisory |
| Red Hat Customer Portal - Access to 24x7 support and knowledge | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Third Party Advisory |
| 2044583 – (CVE-2021-4217) CVE-2021-4217 unzip: Null pointer dereference in Unicode strings code | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Exploit, Issue Tracking, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 198984 Ubuntu Security Notification for unzip Vulnerabilities (USN-5673-1)
- 296063 Oracle Solaris 11.4 Support Repository Update (SRU) 45.119.2 Missing (CPUAPR2022)
- 354477 Amazon Linux Security Advisory for unzip : ALAS2022-2022-221
- 354574 Amazon Linux Security Advisory for unzip : ALAS-2022-221
- 354660 Amazon Linux Security Advisory for unzip : ALAS2-2023-1906
- 355191 Amazon Linux Security Advisory for unzip : ALAS2023-2023-029
- 502799 Alpine Linux Security Update for unzip
- 672390 EulerOS Security Update for unzip (EulerOS-SA-2022-2747)
- 672396 EulerOS Security Update for unzip (EulerOS-SA-2022-2782)
- 672400 EulerOS Security Update for unzip (EulerOS-SA-2022-2809)
- 672443 EulerOS Security Update for unzip (EulerOS-SA-2022-2834)
- 672466 EulerOS Security Update for unzip (EulerOS-SA-2022-2860)
- 903737 Common Base Linux Mariner (CBL-Mariner) Security Update for unzip (10708)
- 903875 Common Base Linux Mariner (CBL-Mariner) Security Update for unzip (10680)
- 905670 Common Base Linux Mariner (CBL-Mariner) Security Update for unzip (10708-1)
- 906577 Common Base Linux Mariner (CBL-Mariner) Security Update for unzip (10708-3)