Critical Vulnerability in binutils Package: CVE-2021-3487
Summary
ALPINE-CVE-2021-3487: Rejected reason: Non Security Issue. See the binutils security policy for more details, https://sourceware.org/cgit/binutils-gdb/tree/binutils/SECURITY.txt. Affects binutils versions < 2.33.1-r1. Fixed in 2.33.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The binutils package is a collection of tools for managing binary files, including object files, archives, and executable files. It is widely used in various software development environments for tasks such as linking and debugging. The package is essential for developers working with compiled languages, as it provides utilities that facilitate the manipulation of binary files. However, the binutils package has been identified with a vulnerability that could potentially affect the integrity and security of applications relying on it.
Vulnerability Detail
CVE-2021-3487 is a non-security issue that has been documented in the binutils security policy. Although it is categorized as a non-security vulnerability, it is crucial to understand that it could lead to unexpected behavior in applications that utilize the affected versions of binutils. The vulnerability originates from specific flaws in the handling of binary files, which could allow for improper execution or manipulation of binaries, potentially leading to data corruption or application crashes.
How To Fix
Minimum fixed version
2.33.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade binutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As the issue is categorized as a non-security vulnerability, there are no specific workarounds provided. However, users are encouraged to monitor their applications for any unusual behavior and consider upgrading to the latest stable version of binutils as a precautionary measure.
Conclusion
The binutils package has been identified with a vulnerability (CVE-2021-3487) that, while categorized as a non-security issue, could still impact application behavior. Users are encouraged to update to the latest patched versions to mitigate any potential risks associated with this vulnerability.
See every vulnerability recorded for binutils →
FAQ
CVE-2021-3487 is a documented vulnerability in the binutils package that could lead to unexpected behavior in applications using affected versions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Versions of binutils prior to 2.33.1-r1 for Alpine v3.10 and v3.11, and prior to 2.34-r2 for v3.12, and prior to 2.35.2-r1 for v3.13 and later are affected.
Yes, patched versions of binutils are available. Users should update to the specified patched versions based on their Alpine Linux version.
While there are no specific workarounds, it is advisable to monitor your applications for any unusual behavior until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
