Moderate: gcc security update
Summary
ALSA-2021:4587: Moderate: gcc security update. Affects cpp versions < 8.5.0-4.el8_5.alma. Fixed in 8.5.0-4.el8_5.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries.
Vulnerability Detail
The gcc package is vulnerable to a security issue related to Unicode's bidirectional (BiDi) override characters. This vulnerability, identified as CVE-2021-42574, can lead to trojan source attacks. The issue arises from the improper handling of bidirectional characters, which can be exploited to execute malicious code or manipulate the behavior of the compiler.
How To Fix
Minimum fixed version
8.5.0-4.el8_5.alma
This is the first release that contains the fix.
sudo dnf update cppTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The gcc package is vulnerable to a security issue related to bidirectional characters. To mitigate this vulnerability, it is recommended to update the gcc package to the fixed version and enable the new warning option. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for cpp →
FAQ
This vulnerability can be exploited to execute malicious code or manipulate the behavior of the gcc compiler.
You can use Vulert's playground (https://vulert.com/scanner) to check if your gcc package is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it in real-time.
The recommended mitigation is to update the gcc package to the fixed version and enable the new warning option (-Wbidirectional) to detect and warn about potentially dangerous bidirectional characters.
The CVSS score for this vulnerability is not mentioned in the provided information.
You can refer to the CVE page for CVE-2021-42574 for more details about this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for cpp.
