CVE-2021-46848: 
NixOS vulnerability analysis and mitigation

GNU Libtasn1 before version 4.19.0 contains a vulnerability identified as CVE-2021-46848, which involves an ETYPE_OK off-by-one array size check affecting the asn1_encode_simple_der function. The vulnerability was discovered in October 2022 and affects various Linux distributions and systems using the GNU Libtasn1 library (NVD, NetApp Advisory).

The vulnerability is classified as an off-by-one error (CWE-193) in the ETYPE_OK array size check. It has received a CVSS v3.1 base score of 9.1 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD).

The successful exploitation of this vulnerability could lead to disclosure of sensitive information or result in a Denial of Service (DoS) condition. The vulnerability enables access to one additional memory byte, which somewhat constrains the potential damage an attacker could inflict (NetApp Advisory).

The vulnerability is accessible over the network and requires low attack complexity with no authentication. It involves an out-of-bounds read in the API when using invalid values, though it is noted as not likely to be exploitable in any significant way (Ubuntu Security).

The vulnerability has been fixed in GNU Libtasn1 version 4.19.0. Various distributions have released security updates to address this issue, including Debian, Fedora, and Ubuntu. Users are advised to upgrade their libtasn1 packages to the latest version (Debian LTS, Fedora Update).