CVE-2021-4213

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2021-4213	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2042900	Issue Tracking Patch Third Party Advisory
https://github.com/dogtagpki/jss/commit/3aabe0e9d59b0a42e68ac8cd0468f9c5179967d2	Patch Third Party Advisory
https://github.com/dogtagpki/jss/commit/5922560a78d0dee61af8a33cc9cfbf4cfa291448	Patch Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2021-4213	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dogtagpki:network_security_services_for_java::::::::
	cpe:2.3:a:dogtagpki:network_security_services_for_java::::::::

Configuration 2 (hide)

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR	cpe:2.3:o:debian:debian_linux:10.0:::::::*
	cpe:2.3:o:debian:debian_linux:11.0:::::::*

History

No history.

Information

Published : 2022-08-24 16:15

Updated : 2024-02-28 19:29

NVD link : CVE-2021-4213

Mitre link : CVE-2021-4213

CVE.ORG link : CVE-2021-4213

JSON object : View

Products Affected

debian

debian_linux

redhat

enterprise_linux

dogtagpki

network_security_services_for_java

CWE

CWE-401

Missing Release of Memory after Effective Lifetime

{"id": "CVE-2021-4213", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-08-24T16:15:09.980", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2021-4213", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2042900", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/dogtagpki/jss/commit/3aabe0e9d59b0a42e68ac8cd0468f9c5179967d2", "tags": ["Patch", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/dogtagpki/jss/commit/5922560a78d0dee61af8a33cc9cfbf4cfa291448", "tags": ["Patch", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://security-tracker.debian.org/tracker/CVE-2021-4213", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-401"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server\u2019s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service."}, {"lang": "es", "value": "Se ha encontrado un fallo en JSS, que no libera apropiadamente toda la memoria. Con el tiempo, la memoria desperdiciada es acumulada en la memoria del servidor, saturando la RAM del mismo. Este fallo permite a un atacante forzar la invocaci\u00f3n de un proceso fuera de memoria, causando una denegaci\u00f3n de servicio."}], "lastModified": "2022-08-29T13:19:08.073", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dogtagpki:network_security_services_for_java:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE906ED1-3382-4027-81C4-4572B2E27BC2", "versionEndExcluding": "4.9.3"}, {"criteria": "cpe:2.3:a:dogtagpki:network_security_services_for_java:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC95A8E0-BC9C-495E-B675-A2ECD52CC984", "versionEndExcluding": "5.1.0", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}, {"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}