CVE-2021-46848 @ Janus

"CVE-2021-46848"
"libtasn1-6-4.13-3+deb10u1"
"libtasn1-6"
"Am I vulnerable?"

Status

new

Priority

1.36

Match score

4.0

Risk

Other Remote priv:user

CVSS

9.1 CRITICAL

Reason

cpe: libtasn1; pkgs: libtasn1-6; version: in-range: libtasn1-6-4.13-3+deb10u1

Created

2026-10-15T10:20:35Z

Updated

2026-10-20T10:18:44Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

Package	Commands
libtasn1-6-4.13-3+deb10u1
libtasn1-6

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: libtasn1 · libtasn1-6

System	Matches	Ticket for CVE-2021-46848
Archive	libtasn1-6 4.13-3+deb10u1	new open
Janus	libtasn1-6 4.13-3+deb10u1	new open
Library	libtasn1-6 4.10-1.1+deb9u1	new open
Saiph	libtasn1-6 4.13-3+deb10u1	new open
Bullseye	libtasn1-6 4.16.0-2+deb11u2	none
Helios	libtasn1-6 4.16.0-2+deb11u2	none
Matrix	libtasn1-6 4.19.0-2+deb12u1	none
Silk	libtasn1-6 4.19.0-2+deb12u1	none

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

Debian GNU/Linux 10 (buster) (10) · debian

Arch

x86_64

kernel_release

uname -r → 4.19.0-27-amd64

kernel_version

uname -v → #1 SMP Debian 4.19.316-1 (2024-06-25)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
morris	new	9.1	2026-10-20T10:18:44Z	Open
mufasa	new	9.1	2026-10-20T10:18:44Z	Open
Library	new	2.73	2026-10-20T10:18:44Z	Open
Archive	new	1.36	2026-10-20T10:18:44Z	Open
Saiph	new	1.36	2026-10-20T10:18:44Z	Open

Description

GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.

Update status

Add note only

References

NVD: CVE-2021-46848