CVE-2021-21369

{"id": "CVE-2021-21369", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2021-03-09T18:15:18.047", "references": [{"url": "https://github.com/hyperledger/besu/blob/master/CHANGELOG.md#151", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/hyperledger/besu/commit/06e35a58c07a30c0fbdc0aae45a3e8b06b53c022", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/hyperledger/besu/pull/1144", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/hyperledger/besu/security/advisories/GHSA-qgfj-mjpc-7w3q", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API service. If username and password authentication is enabled for the HTTP JSON-RPC API service, then prior to making any requests to an API endpoint the requestor must use the login endpoint to obtain a JSON web token (JWT) using their credentials. A single user can readily overload the login endpoint with invalid requests (incorrect password). As the supplied password is checked for validity on the main vertx event loop and takes a relatively long time this can cause the processing of other valid requests to fail. A valid username is required for this vulnerability to be exposed. This has been fixed in version 1.5.1."}, {"lang": "es", "value": "Hyperledger Besu es un cliente Ethereum de c\u00f3digo abierto, compatible con MainNet, escrito en Java. En Besu versiones anteriores a 1.5.1 se presenta una vulnerabilidad de denegaci\u00f3n de servicio que involucra al servicio HTTP JSON-RPC API . Si la autenticaci\u00f3n de nombre de usuario y contrase\u00f1a est\u00e1 habilitada para el servicio de HTTP JSON-RPC API , antes de realizar cualquier petici\u00f3n a un endpoint de la API, el solicitante debe usar el endpoint de inicio de sesi\u00f3n para obtener un token web JSON (JWT) con sus credenciales. Un solo usuario puede sobrecargar f\u00e1cilmente el endpoint de inicio de sesi\u00f3n con peticiones no v\u00e1lidas (contrase\u00f1a incorrecta). Como se comprueba la validez de la contrase\u00f1a proporcionada en el bucle de eventos principal de vertx y lleva un tiempo relativamente largo, esto puede causar que el procesamiento de otras peticiones v\u00e1lidas presenten un fallo. Es requerido un nombre de usuario v\u00e1lido para que se exponga esta vulnerabilidad. Esto ha sido corregido en la versi\u00f3n 1.5.1"}], "lastModified": "2021-03-16T17:25:35.820", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:besu:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "236DADDD-59BD-4AD7-9B91-16F5A30FFA0D", "versionEndExcluding": "1.5.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}