CVE-2021-3998

Name	CVE-2021-3998
Description	A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glibc (PTS)	jessie, jessie (lts)	2.19-18+deb8u14	fixed
	stretch (security)	2.24-11+deb9u1	fixed
	stretch (lts), stretch	2.24-11+deb9u7	fixed
	buster (security), buster, buster (lts)	2.28-10+deb10u4	fixed
	bullseye	2.31-13+deb11u11	fixed
	bullseye (security)	2.31-13+deb11u10	fixed
	bookworm	2.36-9+deb12u9	fixed
	bookworm (security)	2.36-9+deb12u7	fixed
	sid, trixie	2.40-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
glibc	source	jessie	(not affected)
glibc	source	stretch	(not affected)
glibc	source	buster	(not affected)
glibc	source	bullseye	(not affected)
glibc	source	(unstable)	2.33-4

Notes

[bullseye] - glibc <not-affected> (Vulnerable code introduced later)
[buster] - glibc <not-affected> (Vulnerable code introduced later)
[stretch] - glibc <not-affected> (Vulnerable code introduced later)
https://sourceware.org/bugzilla/show_bug.cgi?id=28770
https://patchwork.sourceware.org/project/glibc/patch/20220113055920.3155918-1-siddhesh@sourceware.org/
https://www.openwall.com/lists/oss-security/2022/01/24/4
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ee8d5e33adb284601c00c94687bc907e10aec9bb
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=f7a79879c0b2bef0dadd6caaaeeb0d26423e04e5
introduced in 2.33 by: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=c6e0b0b5b0b7922cdf0dce2af671e0c7e500df95
[jessie] - glibc <not-affected> (Vulnerable code introduced later)