The named text file contains a Unicode codepoint that has been identified as a potential security risk.
There are two distinct attack vectors. One is homoglyphs in which text looks confusingly similar to what a reader might expects, but is actually different. The second is birectional attacks, in which the rendered text hides potentially malicious characters.
Here are the relevant codepoints:
- ARABIC LETTER MARK (
- LEFT-TO-RIGHT MARK (
- RIGHT-TO-LEFT MARK (
- LEFT-TO-RIGHT EMBEDDING (
- RIGHT-TO-LEFT EMBEDDING (
- POP DIRECTIONAL FORMATTING (
- LEFT-TO-RIGHT OVERRIDE (
- RIGHT-TO-LEFT OVERRIDE (
- LEFT-TO-RIGHT ISOLATE (
- RIGHT-TO-LEFT ISOLATE (
- FIRST STRONG ISOLATE (
- POP DIRECTIONAL ISOLATE (
You can also run a similar check in your shell with that command:
grep -r $'[\u061C\u200E\u200F\u202A\u202B\u202C\u202D\u202E\u2066\u2067\u2068\u2069]'
The registered vulnerabilities are CVE-2021-42694 ("Homoglyph") and CVE-2021-42574 ("Bidirectional Attack").
For more information please consult:
The tag is present in Lintian version
That is the most recent version we know about.
We use semantic versions.
The patch number is a commit step indicator relative to the
release tag in our Git
You can find the detection logic for this version at commit d219a5a. For merge requests, please use the latest version in the Lintian check files/unicode/trojan.
This tag is experimental.