CVSS: 8.5EPSS: 0%CPEs: 5EXPL: 7CVE-2021-42574 – environment: Unicode's bidirectional (BiDi) override characters can cause trojan source attacks
https://notcve.org/view.php?id=CVE-2021-42574
An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). • https://github.com/simplylu/CVE-2021-42574 https://github.com/waseeld/CVE-2021-42574 https://github.com/shiomiyan/CVE-2021-42574 http://www.openwall.com/lists/oss-security/2021/11/01/1 http://www.openwall.com/lists/oss-security/2021/11/01/4 http://www.openwall.com/lists/oss-security/2021/11/01/5 http://www.openwall.com/lists/oss-security/2021/11/01/6 http://www.openwall.com/lists/oss-security/2021/11/02/10 http://www.unicode.org/versions/Unicod • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-838: Inappropriate Encoding for Output Context •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 2CVE-2021-42694
https://notcve.org/view.php?id=CVE-2021-42694
An issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allows an adversary to produce source code identifiers such as function names using homoglyphs that render visually identical to a target identifier. Adversaries can leverage this to inject code via adversarial identifier definitions in upstream software dependencies invoked deceptively in downstream software. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard (all versions). • https://github.com/simplylu/CVE-2021-42694 http://www.openwall.com/lists/oss-security/2021/11/01/1 http://www.openwall.com/lists/oss-security/2021/11/01/6 http://www.unicode.org/versions/Unicode14.0.0 https://cwe.mitre.org/data/definitions/1007.html https://security.gentoo.org/glsa/202210-09 https://trojansource.codes https://www.kb.cert.org/vuls/id/999008 https://www.scyon.nl/post/trojans-in-your-source-code https://www.unicode.org/reports/tr36 https& • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10578
https://notcve.org/view.php?id=CVE-2016-10578
unicode loads unicode data downloaded from unicode.org into nodejs. Unicode before 9.0.0 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. Unicode carga datos Unicode descargados de unicode.org en nodejs. Unicode en versiones anteriores a la 9.0.0 descarga recursos binarios por HTTP, lo que lo deja vulnerable a ataques MITM. • https://nodesecurity.io/advisories/161 • CWE-310: Cryptographic Issues CWE-311: Missing Encryption of Sensitive Data •