CVE-2021-42574

Published on: 10/31/2021 12:00:00 AM UTC

Last Modified on: 10/25/2022 04:38:00 PM UTC

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Certain versions of Fedora from Fedoraproject contain the following vulnerability:

** DISPUTED ** An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-right and right-to-left characters, the visual order of tokens may be different from their logical order. Additionally, control characters needed to fully support the requirements of bidirectional text can further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such that the ordering of tokens perceived by human reviewers does not match what will be processed by a compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.

  • CVE-2021-42574 has been assigned by URL Logo [email protected] to track the vulnerability - currently rated as HIGH severity.

CVSS3 Score: 8.3 - HIGH

Attack
Vector
Attack
Complexity
Privileges
Required
User
Interaction
NETWORK HIGH NONE REQUIRED
Scope Confidentiality
Impact
Integrity
Impact
Availability
Impact
CHANGED HIGH HIGH HIGH

CVSS2 Score: 5.1 - MEDIUM

Access
Vector
Access
Complexity
Authentication
NETWORK HIGH NONE
Confidentiality
Impact
Integrity
Impact
Availability
Impact
PARTIAL PARTIAL PARTIAL

CVE References

Description Tags Link
Trojans in your source code www.scyon.nl
text/html
URL Logo MISC www.scyon.nl/post/trojans-in-your-source-code
oss-security - CVE-2021-42574: rustc 1.56.0 and bidirectional-override codepoints in source code www.openwall.com
text/html
URL Logo MLIST [oss-security] 20211101 CVE-2021-42574: rustc 1.56.0 and bidirectional-override codepoints in source code
oss-security - Trojan Source Attacks www.openwall.com
text/html
URL Logo MLIST [oss-security] 20211101 Trojan Source Attacks
Rust: Multiple Vulnerabilities (GLSA 202210-09) — Gentoo security security.gentoo.org
text/html
URL Logo GENTOO GLSA-202210-09
[SECURITY] Fedora 33 Update: rust-1.56.1-1.fc33 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
text/html
URL Logo FEDORA FEDORA-2021-443139f67c
UAX #31: Unicode Identifier and Pattern Syntax www.unicode.org
text/html
URL Logo MISC www.unicode.org/reports/tr31/
[SECURITY] Fedora 35 Update: rust-1.56.1-1.fc35 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
text/html
URL Logo FEDORA FEDORA-2021-7ad3a01f6a
oss-security - Re: Trojan Source Attacks www.openwall.com
text/html
URL Logo MLIST [oss-security] 20211102 Re: Trojan Source Attacks
[SECURITY] Fedora 34 Update: rust-1.56.1-1.fc34 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
text/html
URL Logo FEDORA FEDORA-2021-0578e23912
VU#999008 - Compilers permit Unicode control and homoglyph characters www.kb.cert.org
text/html
URL Logo CERT-VN VU#999008
oss-security - Re: CVE-2021-42574: rustc 1.56.0 and bidirectional-override codepoints in source code www.openwall.com
text/html
URL Logo MLIST [oss-security] 20211102 Re: CVE-2021-42574: rustc 1.56.0 and bidirectional-override codepoints in source code
CVE-2021-42574 Bidirectional Algorithm issue in StarWind Products www.starwindsoftware.com
text/html
URL Logo MISC www.starwindsoftware.com/security/sw-20220804-0002/
UTR #36: Unicode Security Considerations www.unicode.org
text/html
URL Logo MISC www.unicode.org/reports/tr36/
UAX #9: Unicode Bidirectional Algorithm www.unicode.org
text/html
URL Logo MISC www.unicode.org/reports/tr9/tr9-44.html#HL4
Unicode 14.0.0 www.unicode.org
text/html
URL Logo MISC www.unicode.org/versions/Unicode14.0.0/
oss-security - Re: CVE-2021-42574: rustc 1.56.0 and bidirectional-override codepoints in source code www.openwall.com
text/html
URL Logo MLIST [oss-security] 20211101 Re: CVE-2021-42574: rustc 1.56.0 and bidirectional-override codepoints in source code
UTS #39: Unicode Security Mechanisms www.unicode.org
text/html
URL Logo MISC www.unicode.org/reports/tr39/
Trojan Source Attacks trojansource.codes
text/html
URL Logo MISC trojansource.codes

Related QID Numbers

  • 159440 Oracle Enterprise Linux Security Update for binutils (ELSA-2021-4033)
  • 159524 Oracle Enterprise Linux Security Update for gcc-toolset-10-gcc (ELSA-2021-4585)
  • 159525 Oracle Enterprise Linux Security Update for gcc-toolset-11-gcc (ELSA-2021-4586)
  • 159526 Oracle Enterprise Linux Security Update for gcc (ELSA-2021-4587)
  • 159527 Oracle Enterprise Linux Security Update for rust-toolset:ol8 (ELSA-2021-4590)
  • 159528 Oracle Enterprise Linux Security Update for gcc-toolset-11-annobin (ELSA-2021-4591)
  • 159529 Oracle Enterprise Linux Security Update for gcc-toolset-10-annobin (ELSA-2021-4592)
  • 159530 Oracle Enterprise Linux Security Update for annobin (ELSA-2021-4593)
  • 159531 Oracle Enterprise Linux Security Update for gcc-toolset-11-binutils (ELSA-2021-4594)
  • 159532 Oracle Enterprise Linux Security Update for binutils (ELSA-2021-4595)
  • 159536 Oracle Enterprise Linux Security Update for gcc-toolset-10-binutils (ELSA-2021-4649)
  • 159537 Oracle Enterprise Linux Security Update for llvm-toolset:ol8 (ELSA-2021-4743)
  • 239748 Red Hat Update for binutils (RHSA-2021:4033)
  • 239749 Red Hat Update for devtoolset-10-gcc (RHSA-2021:4039)
  • 239850 Red Hat Update for gcc-toolset-11-binutils (RHSA-2021:4594)
  • 239851 Red Hat Update for gcc-toolset-10-annobin (RHSA-2021:4589)
  • 239854 Red Hat Update for binutils (RHSA-2021:4595)
  • 239855 Red Hat Update for gcc-toolset-10-annobin (RHSA-2021:4592)
  • 239856 Red Hat Update for gcc (RHSA-2021:4587)
  • 239857 Red Hat Update for binutils (RHSA-2021:4602)
  • 239858 Red Hat Update for gcc-toolset-10-gcc (RHSA-2021:4585)
  • 239859 Red Hat Update for annobin (RHSA-2021:4600)
  • 239861 Red Hat Update for gcc-toolset-11-gcc (RHSA-2021:4586)
  • 239862 Red Hat Update for annobin (RHSA-2021:4598)
  • 239863 Red Hat Update for annobin (RHSA-2021:4599)
  • 239864 Red Hat Update for gcc-toolset-11-annobin (RHSA-2021:4591)
  • 239866 Red Hat Update for binutils (RHSA-2021:4596)
  • 239867 Red Hat Update for binutils (RHSA-2021:4601)
  • 239868 Red Hat Update for gcc-toolset-10-binutils (RHSA-2021:4588)
  • 239870 Red Hat Update for annobin (RHSA-2021:4593)
  • 239872 Red Hat Update for rust-toolset:rhel8 (RHSA-2021:4590)
  • 239883 Red Hat Update for devtoolset-11-gcc (RHSA-2021:4669)
  • 239886 Red Hat Update for gcc-toolset-10-binutils (RHSA-2021:4649)
  • 239897 Red Hat Update for devtoolset-10-annobin (RHSA-2021:4724)
  • 239898 Red Hat Update for devtoolset-10-binutils (RHSA-2021:4723)
  • 239899 Red Hat Update for devtoolset-11-binutils (RHSA-2021:4730)
  • 239900 Red Hat Update for llvm-toolset:rhel8 (RHSA-2021:4743)
  • 239901 Red Hat Update for devtoolset-11-annobin (RHSA-2021:4729)
  • 257129 CentOS Security Update for binutils (CESA-2021:4033)
  • 282032 Fedora Security Update for rust (FEDORA-2021-0578e23912)
  • 282046 Fedora Security Update for rust (FEDORA-2021-443139f67c)
  • 296086 Oracle Solaris 11.4 Support Repository Update (SRU) 51.132.1 Missing (CPUOCT2022)
  • 353280 Amazon Linux Security Advisory for gcc10, gcc : ALAS2-2022-1784
  • 354359 Amazon Linux Security Advisory for gcc : ALAS2022-2022-222
  • 354368 Amazon Linux Security Advisory for gcc : ALAS2022-2022-057
  • 354573 Amazon Linux Security Advisory for gcc : ALAS-2022-222
  • 377278 Alibaba Cloud Linux Security Update for binutils (ALINUX2-SA-2021:0062)
  • 377566 Alibaba Cloud Linux Security Update for rust-toolset:rhel8 (ALINUX3-SA-2022:0116)
  • 502185 Alpine Linux Security Update for rust
  • 671352 EulerOS Security Update for binutils (EulerOS-SA-2022-1262)
  • 671451 EulerOS Security Update for binutils (EulerOS-SA-2022-1443)
  • 671471 EulerOS Security Update for binutils (EulerOS-SA-2022-1422)
  • 671496 EulerOS Security Update for binutils (EulerOS-SA-2022-1481)
  • 671514 EulerOS Security Update for binutils (EulerOS-SA-2022-1500)
  • 672406 EulerOS Security Update for binutils (EulerOS-SA-2022-2789)
  • 710640 Gentoo Linux Rust Multiple Vulnerabilities (GLSA 202210-09)
  • 730247 Atlassian Jira Server and Data Center Code Injection Vulnerability (JRASERVER-72978)
  • 730338 Atlassian Confluence Server Code Injection Vulnerability (CONFSERVER-74534)
  • 730343 Atlassian Bitbucket Server and Data Center Code Injection Vulnerability (CVE-2021-42574)
  • 730371 McAfee Web Gateway Multiple Vulnerabilities (WP-3335,WP-4131,WP-4159,WP-4237,WP-4259,WP-4329,WP-4348,WP-4355,WP-4376,WP-4407,WP-4421)
  • 730383 Atlassian Bamboo Server and Data Center Code Injection Vulnerability (CVE-2021-42574)
  • 730464 Atlassian Jira Service Management Server and Insight Asset Management Vulnerability (JSDSERVER-10843)
  • 940110 AlmaLinux Security Update for gcc-toolset-10-binutils (ALSA-2021:4649)
  • 940112 AlmaLinux Security Update for gcc-toolset-11-annobin (ALSA-2021:4591)
  • 940115 AlmaLinux Security Update for rust-toolset:rhel8 (ALSA-2021:4590)
  • 940133 AlmaLinux Security Update for gcc (ALSA-2021:4587)
  • 940190 AlmaLinux Security Update for gcc-toolset-10-gcc (ALSA-2021:4585)
  • 940240 AlmaLinux Security Update for gcc-toolset-10-annobin (ALSA-2021:4592)
  • 940301 AlmaLinux Security Update for llvm-toolset:rhel8 (ALSA-2021:4743)
  • 940342 AlmaLinux Security Update for gcc-toolset-11-gcc (ALSA-2021:4586)
  • 940360 AlmaLinux Security Update for gcc-toolset-11-binutils (ALSA-2021:4594)
  • 940374 AlmaLinux Security Update for binutils (ALSA-2021:4595)
  • 940410 AlmaLinux Security Update for annobin (ALSA-2021:4593)
  • 960433 Rocky Linux Security Update for gcc-toolset-10-gcc (RLSA-2021:4585)

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
Operating
System
FedoraprojectFedora33AllAllAll
Operating
System
FedoraprojectFedora34AllAllAll
Operating
System
FedoraprojectFedora35AllAllAll
ApplicationStarwindsoftwareStarwind Virtual Sanv8r1314398AllAll
ApplicationUnicodeUnicodeAllAllAllAll
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*:
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*:
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*:
  • cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8r13:14398:*:*:*:*:*:*:
  • cpe:2.3:a:unicode:unicode:*:*:*:*:*:*:*:*:

Social Mentions

Source Title Posted (UTC)
Twitter Icon @rustlang We have a security advisory for rustc today: blog.rust-lang.org/2021/11/01/cve… We will have a 1.56.1 release out soon. 2021-11-01 00:09:20
Twitter Icon @lo48576 Security advisory for rustc (CVE-2021-42574) | Rust Blog blog.rust-lang.org/2021/11/01/cve… rustc に問題があるわけではないが、 Unicode の bi… twitter.com/i/web/status/1… 2021-11-01 00:56:22
Twitter Icon @pluc blog.rust-lang.org/2021/11/01/cve… 2021-11-01 01:07:44
Twitter Icon @diffblog Security advisory for rustc (CVE-2021-42574) blog.rust-lang.org/2021/11/01/cve… 2021-11-01 01:20:04
Twitter Icon @ekuber @_myrrlyn @mgattozzi_priv @strega_nil I believe this was referencing blog.rust-lang.org/2021/11/01/cve… 2021-11-01 01:22:16
Twitter Icon @IgnotumAliquis @rossjanderson @VessOnSecurity Both CVE-2021-42574 and CVE-2021-42694. What am I doing wrong? https://t.co/rWjxYHeW8i 2021-11-01 01:23:08
Twitter Icon @okapies Unicode の右から書く言語(アラビア語とか)への対応を悪用すると、レビューツールで表示されるコードが実際のソースコードと違う、みたいなことができるらしい。 blog.rust-lang.org/2021/11/01/cve… 2021-11-01 01:23:47
Twitter Icon @angsuman Security advisory for rustc (CVE-2021-42574) blog.rust-lang.org/2021/11/01/cve… 2021-11-01 01:41:04
Twitter Icon @lathiat Interesting new CVE-2021-42574 "Trojan Source" today. Fantastic write-up on the Rust blog. Unicode "bi-directional… twitter.com/i/web/status/1… 2021-11-01 01:47:28
Twitter Icon @planetmozilla The Rust Programming Language Blog: Security advisory for rustc (CVE-2021-42574) ift.tt/3BDEJ5e 2021-11-01 02:56:39
Twitter Icon @Linda_pp これ GitHub 側の対応も同時に入ったのか.どうやら CVE-2021-42574 は Rust 限定の話じゃなかったっぽい github.blog/changelog/2021… 2021-11-01 03:13:10
Twitter Icon @7h3m4dS0u1 blog.rust-lang.org/2021/11/01/cve… #rustlang 2021-11-01 03:14:23
Twitter Icon @passcod @Eramdam blog.rust-lang.org/2021/11/01/cve… github.blog/changelog/2021… trojansource.codes 2021-11-01 03:16:49
Twitter Icon @kyleb_cc @steveklabnik The CVE link in that article goes to which has no info and links to… twitter.com/i/web/status/1… 2021-11-01 04:01:28
Twitter Icon @CVEreport CVE-2021-42574 : An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0.… twitter.com/i/web/status/1… 2021-11-01 04:04:26
Twitter Icon @FakeUnicode Both relevant CVEs on @MITREcorp: 2021-11-01 04:50:16
Reddit Logo Icon /r/rust Security advisory for rustc (CVE-2021-42574) 2021-11-01 00:05:48
Reddit Logo Icon /r/devopsish Security advisory for rustc (CVE-2021-42574) | Rust Blog 2021-11-01 00:33:46
Reddit Logo Icon /r/bag_o_news Multiple Products Security Advisory - Unrendered unicode bidirectional override characters - CVE-2021-42574 | Atlassian Support | Atlassian Documentation 2021-11-01 22:43:38
Reddit Logo Icon /r/bag_o_news Multiple Products Security Advisory - Unrendered unicode bidirectional override characters - CVE-2021-42574 | Atlassian Support | Atlassian Documentation 2021-11-01 22:40:54
Reddit Logo Icon /r/Unicode Thoughts on the BiDi Algorithm CVE (aka “TrojanSource”)? 2021-11-02 02:20:57
Reddit Logo Icon /r/atlassian Security advisory .. again and again...CVE-2021-42574 2021-11-02 06:14:33
Reddit Logo Icon /r/Wordpress WordPress and the new vulnerability Trojan Source (CVE-2021-42694 and CVE-2021-42574) 2021-11-04 15:10:42
Reddit Logo Icon /r/netsec WordPress and the new vulnerability Trojan Source (CVE-2021-42694 and CVE-2021-42574) 2021-11-04 15:10:20
Reddit Logo Icon /r/nutanix AOS 5.20.3 available! 2022-01-25 08:34:08
Reddit Logo Icon /r/microsoft CVE-2021-42574 2022-02-10 16:36:52
Reddit Logo Icon /r/solidity POC of CVE-2021-42574 for solidity and solc compiler 2023-01-31 21:21:09
© CVE.report 2023 Twitter Nitter Twitter Viewer |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report