Security readout for executives and security teams
Plain-English summary
This flaw affects GNU Libtasn1 before 4.19.0, a library that encodes ASN.1 data. A boundary-check mistake could allow serious confidentiality loss and service disruption under the CVSS model. The source bundle does not show active exploitation, but the score and unauthenticated network vector make remediation business-relevant.
Executive priority
Treat as a high-priority library vulnerability. There is no sourced evidence of active exploitation, but the critical score, no-auth network vector, and downstream vendor advisories justify timely patching and clear exception tracking.
Technical view
CVE-2021-46848 is a CWE-193 off-by-one array size check in ETYPE_OK affecting asn1_encode_simple_der. The record rates it CVSS 3.1 9.1 with network access, low complexity, no privileges, no user interaction, high confidentiality impact, and high availability impact.
Likely exposure
Exposure is most likely where GNU Libtasn1 or libtasn1-6 is present below 4.19.0, including systems covered by Fedora, Debian LTS, Gentoo, or NetApp advisories. The provided affected-product metadata is incomplete, so confirm through package inventories and vendor advisories.
Exploitation context
The bundle marks KEV as false and provides no cited evidence of active exploitation. Risk is still elevated because the CVSS vector indicates unauthenticated network reachability with low attack complexity. Do not assume exploitability in a specific product without validating how that product uses asn1_encode_simple_der.
Researcher notes
Focus validation on version provenance and call paths to asn1_encode_simple_der. The source bundle identifies the upstream fix commit and issue, but affected-product metadata is sparse. Avoid broad product claims unless confirmed by vendor advisories or local dependency evidence.
Mitigation direction
- Upgrade GNU Libtasn1 to 4.19.0 or a vendor-patched package.
- Apply relevant Fedora, Debian LTS, Gentoo, or NetApp guidance where applicable.
- Prioritize internet-facing systems and appliances using affected packages.
- Check vendor advisories for product-specific fixes before applying assumptions.
- Track exception owners for systems that cannot be upgraded promptly.
Validation and detection
- Inventory installed libtasn1 or libtasn1-6 package versions.
- Confirm whether packages are below 4.19.0 or vendor-patched equivalents.
- Review SBOMs for bundled GNU Libtasn1 copies.
- Map exposed services that process ASN.1 data through affected components.
- Verify remediation through package manager or vendor version evidence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-193: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-46848 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H3.95.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://gitlab.com/gnutls/libtasn1/-/commit/44a700d2051a666235748970c2df047ff207aeb5CVE reference
- https://gitlab.com/gnutls/libtasn1/-/issues/32CVE reference
- https://bugs.gentoo.org/866237CVE reference
- FEDORA-2022-061f857481CVE reference · vendor-advisory
- FEDORA-2022-3c933ffacaCVE reference · vendor-advisory
- FEDORA-2022-19056934a7CVE reference · vendor-advisory
- https://security.netapp.com/advisory/ntap-20221118-0006/CVE reference
- FEDORA-2022-3f9ee1ad91CVE reference · vendor-advisory
- [debian-lts-announce] 20230109 [SECURITY] [DLA 3263-1] libtasn1-6 security updateCVE reference · mailing-list
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Off-by-one Error
Off-by-one Error represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.