CVE-2021-38165 — lynx - security update

Description

Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.

How to fix CVE-2021-38165

To remediate CVE-2021-38165, upgrade the affected package to a fixed version below.

Alpine/lynx—upgrade to 2.8.9_p1-r3 or later
Debian/lynx—upgrade to 2.9.0dev.6-3~deb11u1 or later
—upgrade to 2.8.9dev11-1+deb9u1 or later
—upgrade to 2.8.9rel.1-3+deb10u1 or later

Is CVE-2021-38165 being exploited?

Low — EPSS is 4.3%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

from 0, < 2.8.9_p1-r3
from 0, < 2.9.0dev.6-3~deb11u1
from 0, < 2.8.9dev11-1+deb9u1
from 0, < 2.8.9rel.1-3+deb10u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.3	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References (2)

ADVISORYsecurity.alpinelinux.org/vuln/CVE-2021-38165
ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-38165