CVE-2021-3466

Related Vulnerabilities: CVE-2021-3466  

A flaw was found in libmicrohttpd. A missing bounds check in the post_process_urlencoded function leads to a buffer overflow, allowing a remote attacker to write arbitrary data in an application that uses libmicrohttpd. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Description

A flaw was found in libmicrohttpd. A missing bounds check in the post_process_urlencoded function leads to a buffer overflow, allowing a remote attacker to write arbitrary data in an application that uses libmicrohttpd. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement

This issue did not affect the versions of libmicrohttpd as shipped with Red Hat Enterprise Linux 6, 7, and 8 as the vulnerable code was only introduced in later versions of the library.

This issue did not affect the versions of libmicrohttpd as shipped with Red Hat Enterprise Linux 6, 7, and 8 as the vulnerable code was only introduced in later versions of the library.

Additional Information

  • Bugzilla 1939127: CVE-2021-3466 libmicrohttpd: Buffer overflow issue in URL parser in the post_process_urlencoded function
  • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
  • FAQ: Frequently asked questions about CVE-2021-3466