Alpine: busybox: security update to 0

critical Tenable Cloud Security Plugin ID 403725

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is
supplied but no page argument is given (CVE-2021-42373)

- An incorrect handling of a special element in Busybox's ash applet leads to denial of service when
processing a crafted shell command, due to the shell mistaking specific characters for reserved
characters. This may be used for DoS under rare conditions of filtered command input. (CVE-2021-42375)

- A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted
shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under
very rare conditions of filtered command input. (CVE-2021-42376)

- An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code
execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may
be used for remote code execution under rare conditions of filtered command input. (CVE-2021-42377)

Plugin Details

Severity: Critical

ID: 403725

Version: Revision 1.27

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-42377

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 11/9/2021

Reference Information

CVE: CVE-2021-42373, CVE-2021-42375, CVE-2021-42376, CVE-2021-42377

Detections

Analytics