Multiple vulnerabilities in Red Hat Service Telemetry Framework



Published: 2022-02-22
Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2021-44716
CVE-2021-3521
CWE-ID CWE-20
CWE-347
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Service Telemetry Framework
Server applications / Other server solutions

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU58824

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-44716

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Service Telemetry Framework: 1.4


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2022:0585

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU59993

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-3521

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to an error in RPM's signature functionality, as RPM does not check the binding signature of subkeys before importing them. A remote attacker with ability to add malicious subkey to a legitimate public key can run malicious code on the system.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

Service Telemetry Framework: 1.4


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2022:0585

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###