CVE-2021-3781 - OpenCVE

A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:N/AC:M/Au:N/C:C/I:C/A:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Artifex	Ghostscript
Fedoraproject	Fedora

Configuration 1 [-]

OR	cpe:2.3:a:artifex:ghostscript:9.50:::::::*
	cpe:2.3:a:artifex:ghostscript:9.52:::::::*
	cpe:2.3:a:artifex:ghostscript:9.53.3:::::::*
	cpe:2.3:a:artifex:ghostscript:9.54.0:::::::*

Configuration 2 [-]

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://bugzilla.redhat.com/show_bug.cgi?id=2002271
https://ghostscript.com/CVE-2021-3781.html
https://nvd.nist.gov/vuln/detail/CVE-2021-3781
https://security.gentoo.org/glsa/202211-11
https://www.cve.org/CVERecord?id=CVE-2021-3781

History

No history.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2022-02-16T00:00:00

Updated: 2024-08-03T17:09:08.668Z

Reserved: 2021-09-09T00:00:00

Link: CVE-2021-3781

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-02-16T19:15:08.817

Modified: 2023-06-26T18:56:25.007

Link: CVE-2021-3781

Redhat

Severity : Important

Publid Date: 2021-09-10T00:00:00Z

Links: CVE-2021-3781 - Bugzilla

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:artifex:ghostscript:9.50:*:*:*:*:*:*:*", "matchCriteriaId": "089333A5-72AA-4E68-8A8E-81876AAC9DD3", "vulnerable": true}, {"criteria": "cpe:2.3:a:artifex:ghostscript:9.52:*:*:*:*:*:*:*", "matchCriteriaId": "BF20A2FF-98ED-45EF-9263-D915D7A1953D", "vulnerable": true}, {"criteria": "cpe:2.3:a:artifex:ghostscript:9.53.3:*:*:*:*:*:*:*", "matchCriteriaId": "929DE349-1DA8-4CA9-9646-2BF5D0838E00", "vulnerable": true}, {"criteria": "cpe:2.3:a:artifex:ghostscript:9.54.0:*:*:*:*:*:*:*", "matchCriteriaId": "CBFF1F91-DF46-495C-9FEA-861DA9315376", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*", "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability."}, {"lang": "es", "value": "Se ha encontrado un fallo de escape trivial del sandbox (habilitado con la opci\u00f3n \"-dSAFER\") en el int\u00e9rprete de ghostscript al inyectar un comando de tuber\u00eda especialmente dise\u00f1ado. Este fallo permite que un documento especialmente dise\u00f1ado ejecute comandos arbitrarios en el sistema en el contexto del int\u00e9rprete ghostscript. La mayor amenaza de esta vulnerabilidad es para la confidencialidad, la integridad y la disponibilidad del sistema"}], "id": "CVE-2021-3781", "lastModified": "2023-06-26T18:56:25.007", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-02-16T19:15:08.817", "references": [{"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2002271"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://ghostscript.com/CVE-2021-3781.html"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202211-11"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "ghostscript: sandbox escape using '%pipe%'", "id": "2002271", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2002271"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.", "A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability."], "name": "CVE-2021-3781", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "ghostscript", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "ghostscript", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "ghostscript", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "gimp:flatpak/ghostscript", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "ghostscript", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2021-09-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-3781\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-3781\nhttps://ghostscript.com/CVE-2021-3781.html"], "statement": "This flaw does not affect ghostscript versions prior to 9.50. As a result, Red Hat Enterprise Linux versions 5, 6, 7 and 8 are not affected by this flaw.", "threat_severity": "Important", "upstream_fix": "ghostpdl 9.55.0"}